Repolode
Submit
pythops

pythops/oryx

A terminal UI for sniffing and inspecting network traffic on Linux, built on eBPF.

Open-source alternative to:Wireshark

View on GitHub
Stars
2,595
Forks
75
Open issues
5
Last commit
3 days ago

What is it?

Oryx is a terminal user interface for capturing and inspecting network traffic on Linux. It uses eBPF programs loaded into the kernel to observe packets, so developers and sysadmins can watch live traffic from a shell without installing a separate capture daemon.

The tool covers TCP, UDP and SCTP at the transport layer, IPv4 and IPv6 IP along with ICMP and IGMP, and ARP at the link layer. It offers real-time traffic views, aggregate traffic statistics, a metrics explorer, fuzzy search over captured entries, and basic firewall functionality.

Oryx is written in Rust and runs as root (via sudo). It works best on Linux kernel 6.10 or newer, and on Debian or Ubuntu it needs Debian 13 or Ubuntu 24.04 or later. Pre-built binaries are available, and it can be installed from the Arch Linux extra repository or built from source with a nightly Rust toolchain and bpf-linker.

Key features

  • 01Real-time traffic inspection and visualization in the terminal.
  • 02Traffic statistics and a metrics explorer.
  • 03Protocol coverage including TCP, UDP, SCTP, IP, ICMP, IGMP and ARP.
  • 04Fuzzy search across captured traffic.
  • 05Basic firewall functionality.

Use cases

  • Watching live network traffic on a Linux server from an SSH session.
  • Investigating which connections or protocols a host is using.
  • Adding simple packet-level firewall rules while observing traffic.

Quick start

  1. 1

    Install on Arch Linux via pacman

    pacman -S oryx
  2. 2

    Download a pre-built binary from the release page

  3. 3

    Run oryx with root privileges

    sudo oryx

Things to know

  • Linux only; it does not run on other operating systems.
  • Needs a recent kernel (6.10 or higher is ideal) and eBPF support.
  • Building from source requires the Rust nightly toolchain and bpf-linker.
  • Licensed under GPL-3.0, a copyleft license.

Topics

#ebpf#network#tui#linux#packet-capture#observability#rust#bpf#firewall#kernel

FAQ

What is oryx?
A terminal UI for sniffing and inspecting network traffic on Linux, built on eBPF. Oryx is a terminal user interface for capturing and inspecting network traffic on Linux. It uses eBPF programs loaded into the kernel to observe packets, so developers and sysadmins can watch live traffic from a shell without installing a separate capture daemon.
Is oryx free to use? What license does it have?
oryx is open source under the GPL-3.0 license. Check the license terms before using it in commercial products.
Is oryx still maintained?
Actively maintained. The last commit to oryx was on Oct 18, 2026.
What can I use oryx for?
Watching live network traffic on a Linux server from an SSH session. Investigating which connections or protocols a host is using. Adding simple packet-level firewall rules while observing traffic.
How do I install oryx?
Install on Arch Linux via pacman: pacman -S oryx Download a pre-built binary from the release page Run oryx with root privileges: sudo oryx
Where can I get oryx?
The source code and installation instructions are on GitHub: https://github.com/pythops/oryx

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects