SniffNet Remote Agent to Monitor the Network Adapter on a Remote Host or Hosts

Is there an existing issue for this?

I have searched the existing issues.

Describe the solution you'd like

Setup a Remote Agent for SniffNet, just like Nagios's Remote Agent to Monitor the Network Adapter on a Remote Host or Hosts.
This would be a Option just like in SniffNet when you Pick which Network Adapter you would like to Monitor Network Traffic.
The Remote Agent would be Installed on Windows/Linux and Send Live Data of Network Traffic Information back to SniffNet.

Is your feature request related to a problem?

No response

And... boom! 💥

This is now implemented thanks to PR #1270
The feature is now on the main branch, and will be officially released in a couple months with Sniffnet v1.6.0.

Here is a preview:

ipfix-multi-exporters.mp4

As of now, the available adapters are those identified by pcap and are only internal to the machine on which Sniffnet is installed.

The idea you mentioned would require the development of the remote agent, if I understood correctly, and this is out of scope at the moment.

If you are aware, feel free to link some resource from which I can take inspiration for the modalities of work of remote agents and the transmission of data to the main application.

If the process wouldn't break too much the existing code base, I could consider this feature in the long term.

Thanks!
This seems a bit out of scope at the moment, since many other features are being worked on and none of them is going in the direction of a server + agent application, at least for the moment.

Feel free to leave this issue open, but I'll tag it as wontfix for now.

https://geekpeek.net/nagios-plugin-bash/

https://github.com/NagiosEnterprises/ncpa

https://github.com/NagiosEnterprises/nrpe

https://nsclient.org/

https://github.com/mickem/nscp

I don't think any of these solutions will provide anything more than RX TX counters for each interface. Nagios plugins aren't exporting port and IP src/dst addressing for each flow, it's just a count of how many packets came into and out of each individual network interface.

@GyulyVGC

@GyulyVGC @kenrmayfield
Opensnitch might be a good option, its a firewall made of a daemon and a UI.
But, it can run the daemon without the UI on a remote clients and send the logs to the UI on a different server.
It also supports SIEM integration, so either way you don't need to maintain an agent just read the logs.

https://github.com/evilsocket/opensnitch/wiki/SIEM-integration

@GyulyVGC

@GyulyVGC

Have you thought about making a Agent for Windows and Daemon for Linux so that SniffNet can Sniff
Remote Machines?

@kenrmayfield

Have you thought about making a Agent for Windows and Daemon for Linux so that SniffNet can Sniff Remote Machines?

Hi @kenrmayfield, as I anticipated:

This seems a bit out of scope at the moment, since many other features are being worked on and none of them is going in the direction of a server + agent application, at least for the moment.
Feel free to leave this issue open, but I'll tag it as wontfix for now.

I included this request in the project's roadmap, but it'll be likely one of the last features to be implemented.

I'm seriously considering to introduce this feature in one of the next major releases of the app, probably version 1.6 or 1.7 (see the new Roadmap).

Starting to think about the implementation, I was exploring different possibilities for the protocol to use for data transmission between agent and Sniffnet.

A possible strategy that comes to my mind is to use gRPC, but I'm open to your suggestions.

@GyulyVGC

@GyulyVGC
Having an agent would be excellent but, it may be a lot of extra work and time to maintain it.

Have you thought about using an existing tool and just collecting the data from that. Then you wouldn't be responsible for maintaining an agent but ownley working with its data.

I am not sure if it would work but as an example there is opensnitch and it allows sending data to SIEM

https://github.com/evilsocket/opensnitch/wiki/SIEM-integration

@GyulyVGC

@GyulyVGC

Using a Existing Tool for Collecting Data is not a good idea for SniffNet. If a User wants to Collect Data from Third Party then they would use something like Grafrana, InFluxDB and Telegraf.

You want your on STAMP on SnifNet without Third Party.

A Agent specifically for SniffNet is the Best Way to Go.

Yeah, I'm in fact of the idea of developing a dedicated Sniffnet agent.
While I understand that it'd introduce some maintenance efforts, I plan to keep it as a simple packet capture agent with limited configurations.

I just have to determine which is the best way to transmit data (e.g., gRPC, syslog, raw sockets, etc...).
By "best" I mean that we should satisfy the following:

cross-platform
efficient
type-safe
secure (integrity + encryption + authentication)
minimal to no dependencies

if you want to develop your own agent, then i would go with your original comment of using gRPC

Hey everyone, I plan to start with the development of this feature in the coming weeks so this is one of the last chances to express feedbacks.

What I plan to develop is the following:

a Sniffnet agent exporting network flows in IPFIX format
new capabilities for the Sniffnet app itself to be an IPFIX collector, allowing to gather and show data from multiple IPFIX exporters simultaneously (either from Sniffnet agents or other IPFIX producers)

I often get requests about including support for OPNsense and OpenWRT, and I think such requests could be satisfied by this one.
Please correct me if I'm wrong and in such case feel free to share more about what you'd expect.

I don't know how the architecture will work yet, but having agent support for headerless servers would be great.
Maybe by having a web UI for headerless servers or sending logs to a device with a desktop UI, like OpenSnitch Firewall does.

@GyulyVGC

@GyulyVGC

How you been?

Excellent News to hear.

This is going to be a Great Edition to SniffNet.

I think this is going to push SniffNet even more over the top.

I just had an insightful conversation with the creator of NetGauze Ahmed Elhassany, and IPFIX seems to actually be suitable for what Sniffnet needs to implement this feature, so I'll move forward with the IPFIX-based implementation.

@ahassany

@all-contributors please add @ahassany for ideas.

@GyulyVGC

@GyulyVGC

I've put up a pull request to add @ahassany! 🎉

@GyulyVGC

@GyulyVGC

Great News!!!!

A first step to finally close this issue is complete: I present you sniffnet-agent, the unit in charge to export traffic flows in IPFIX format.

Now what's missing is only the support for collecting IPFIX at Sniffnet-side, which I already started to work on in the ipfix branch.

@GyulyVGC

@GyulyVGC

How you been?

Good News about the SniffNet Agent.

And... boom! 💥

This is now implemented thanks to PR #1270
The feature is now on the main branch, and will be officially released in a couple months with Sniffnet v1.6.0.

Here is a preview:

ipfix-multi-exporters.mp4

Navigation Menu

Repository navigation

SniffNet Remote Agent to Monitor the Network Adapter on a Remote Host or Hosts #303

Is there an existing issue for this?

Describe the solution you'd like

Is your feature request related to a problem?

6 remaining items

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

SniffNet Remote Agent to Monitor the Network Adapter on a Remote Host or Hosts #303

Description

Is there an existing issue for this?

Describe the solution you'd like

Is your feature request related to a problem?

Activity

GyulyVGC commented on Jul 6, 2023

kenrmayfield commented on Jul 8, 2023

GyulyVGC commented on Jul 8, 2023

aderusha commented on Jul 15, 2023

hbednar commented on Aug 2, 2023

kenrmayfield commented on Sep 2, 2023

GyulyVGC commented on Sep 2, 2023

GyulyVGC commented on Jun 19, 2025

zero77 commented on Jun 19, 2025

kenrmayfield commented on Jun 19, 2025

GyulyVGC commented on Jun 19, 2025

zero77 commented on Jun 19, 2025

6 remaining items

GyulyVGC commented on Apr 20, 2026

zero77 commented on Apr 21, 2026

kenrmayfield commented on Apr 21, 2026

GyulyVGC commented on May 11, 2026

GyulyVGC commented on May 11, 2026

allcontributors commented on May 11, 2026

kenrmayfield commented on May 13, 2026

GyulyVGC commented on Jun 12, 2026

kenrmayfield commented on Jun 19, 2026

GyulyVGC commented on Aug 25, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions