Xenoeye is a lightweight, self-hosted Netflow, IPFIX and sFlow collector and analyzer built for medium and large networks. Written in C and using text configuration files, it receives flow exports, aggregates them into fixed time windows and moving averages, and exports the results to PostgreSQL so the data can be turned into reports, Grafana dashboards and threshold-driven alerts.

Key Features

• Flow protocol coverage — collects Netflow v5 and v9, IPFIX and sFlow, either through sockets or by capturing flow traffic with libpcap on a mirrored interface.
• Monitoring objects — a reportable entity can be a network, a group of networks, an autonomous system, a geo-object, or arbitrary traffic extracted from flows with filter expressions; objects can be nested.
• Two aggregation modes — fixed-size time windows for reports and graphs, plus moving averages so traffic spikes and drops below a threshold are noticed within seconds rather than at the end of a collection period.
• Threshold actions and scripts — crossing a moving-average threshold can trigger your own script: enable extended statistics, rate-limit traffic, or act on BGP FlowSpec (filtering, redirection to a scrubbing centre, blackhole) and notify a messenger.
• DoS/DDoS detection by design — the project uses moving averages over per-network traffic to detect volumetric attacks and reacts automatically through FlowSpec and Telegram notifications.
• PostgreSQL storage with volume control — aggregated data by selected flow fields is exported to PostgreSQL; you can export only the top-N entities and fold the rest into a single row to keep the database small. ClickHouse export is also supported.
• Enrichment — GeoIP and autonomous-system databases, traffic classification, interface classification, and DNS/SNI analysis from sFlow data, with a xegeoq helper for looking records up.
• Scales across cores — flows can be split by router across several collector processes, and thresholds or moving averages can be changed without restarting the collector.
• Small footprint — the collector processes and reports on an Orange Pi-class board with 4 GB of RAM; in a network with a few monitoring objects it runs in a VM with one CPU and 1 GB of memory. Throughput is roughly 100K flows/s per CPU with per-flow debug printing and around 700K flows/s per CPU in a production-style configuration.
• Ready-to-run templates — releases ship an LXC container image and a Proxmox template containing the collector, PostgreSQL and Grafana with pre-configured Overview, AS/GeoIP, Routers and DoS/DDoS dashboards.

Requirements

A 64-bit Linux host (x86-64, AArch64 or Elbrus), PostgreSQL for time-series storage, and root or CAP_NET_ADMIN/CAP_NET_RAW capabilities when capturing flow traffic with pcap. Building from source needs a C toolchain, autoconf, libtool and libpcap headers.

Alternatives

• Grafana — dashboarding for the PostgreSQL data xenoeye collects
• Prometheus — metrics collection with its own time-series database
• Netdata — real-time host and network monitoring out of the box