Xenoeye – analyze network without AI using netflow, PostgreSQL, Grafana
Sorry for the slightly truncated title. It should have been "Network traffic analysis and monitoring without AI, using netflow-family protocols, PostgreSQL or ClickHouse, Grafana, and some scripts". In 2026, it might seem a bit presumptuous to announce AI-free software on HN. But building a netflow analyzer manually is no less presumptuous! There are quite a few xFlow analyzers out there these days, and I'm constantly reminded of this. But I think there's always room for an alternative approach. After all, that's how software evolves, isn't it? So, how does xenoeye differ from popular (at…
What it does
In the maker’s words, at launch
Sorry for the slightly truncated title. It should have been "Network traffic analysis and monitoring without AI, using netflow-family protocols, PostgreSQL or ClickHouse, Grafana, and some scripts". In 2026, it might seem a bit presumptuous to announce AI-free software on HN. But building a netflow analyzer manually is no less presumptuous! There are quite a few xFlow analyzers out there these days, and I'm constantly reminded of this. But I think there's always room for an alternative approach. After all, that's how software evolves, isn't it? So, how does xenoeye differ from popular (at least from popular open source) analyzers? - The analyzer has a feature called "monitoring objects". For some reason, open-source analyzers rarely use this feature, while commercial ones do. The monitoring object can be a subnet, autonomous system, geo-object (data on geo and AS are taken from external databases), application traffic (protocol, TCP/UDP ports, etc.), VLAN, etc. Almost everything in flow records can be used as a filter for a monitoring object. Of course, object filters can be composite - the classic operations AND, OR, NOT are supported. The analyzer contains a tiny virtual machine that matches each flow to an object. - We don't store all flows. At least for now. It may seem strange, but this is an important feature, especially for large networks. We store aggregated data on monitored objects. The user chooses what to store. It could be just in/out, top talkers, top protocols, etc. The time for which to aggregate data is also specified by the user. Aggregation occurs inside the analyzer. We use a fast trie-based in-memory db. Because of this, the analyzer can process flows quite quickly (hundreds of thousands of FPS per vCPU) and export a measured amount of information to the database. You can easily use even vanilla PostgreSQL. Or ClickHouse with compression. The analyzer is not very resource-intensive; small network traffic can be processed on low-end hardware or in a VM with a small amount of memory. Or you can process large network traffic on a single server, without building clusters. I know of installations with multi-terabit traffic and hundreds of MOs on a single virtual machine (of course they have a high sampling rate on their routers). - We can monitor traffic thresholds being exceeded using moving averages. That is, as soon as an excess is detected, an external script is launched at the same second (actually even faster). This feature is typically used to detect volumetric DoS/DDoS attacks. The scripts announce BGP Blackhole or BGP Flowspec and notify users via messenger. - We don't have our own visualization utility; we use Grafana. Grafana works with PostgreSQL out of the box, although some complex time-series charts require some tinkering with SQL queries. Ok, it's a controversial decision, but users (and we ourselves) are putting up with it for now. I tried to describe the rest in the documentation. Yes, this isn't the first time I've tried to announce this project on HN, and I'm under no illusions - for some reason, hackers aren't very fond of this type of software. Perhaps everyone thinks that the production of netflow analyzers is too boring a matter, there is nothing to discuss. However, if anyone is interested, it would be great to get feedback. What would you do differently than it was done and why? What do you like most about your favorite analyzer that you can't find anywhere else? How did you even see this post? This isn't AI or even a Rust-related thing
Does the same job
all alternatives →
- NONous – Open-Source Agent Framework with Autonomous, SWE Agents, WebUI2024 · github.com · ▲155
Hello HN! The day has finally come to stop adding features and start sharing what I've been building the last 5-6 months. It's a bit of CrewAI, OpenDevon, LangFuse/Cloud all in one, providing devs who prefer TypeScript an integrated framework thats provides a lot out of the box to start experimenting and building agents with. It started after peeking at the LangChain docs a few times and never liking the example code. I began experimenting with automating a simple Jira request from the engineering team to add an index to one of our Google Spanner databases (for context I'm the…
More ai this month
the category →
I trained a 125M-parameter transformer to autocomplete piano performances in real time (~108 notes/sec on an iPhone 15). The idea is basically GitHub Copilot or Tabnine, except instead of prompting it with code, you prompt it by playing a few notes on a MIDI piano. The model then continues what you played, entirely on-device. The app is free if anyone wants to try it. Happy to answer questions about the model, training, Core ML, or the many things that didn't work.
AI · 16d ago · simedw.com
Astute▲585Automate your B2B brand going viral, with new media creators
AI · 18d ago · company-app.joinastute.com
Hey HN, Henry from Cactus here! We previously released Cactus Needle, a 14MB agentic LLM for tool call, device use, and structured extraction for phones, wearables, smart homes, small robots and microcontrollers. We got really great feedback here, and have now incorporated the suggestions to release Needle 2. The whole model is a single 14MB binary that runs a full session in 28MB of RAM; 45m parameters at 2bit compression. Needle hits 500 tokens/sec decode speed on a Raspberry Pi 5, sits between 400-1,500 tokens/sec on VR devices like Meta Quest 3S and Apple Vision Pro, and ranges…
AI · 26d ago · cactuscompute.com
Launched alongside, June 2026
the whole month →
Fundraisly▲1,544AI fundraising agent that finds investors and books meetings
AI · Jun 2026 · fundraisly.com
- H6Homebrew 6.0.0▲1,481
Today, I’m proud to announce Homebrew 6.0.0. The most significant changes since 5.1.0 are a new tap trust security mechanism, the new faster, smaller, default internal Homebrew JSON API, sandboxing on Linux, better defaults informed by our user survey, many brew bundle improvements, improved performance and initial support for macOS 27 (Golden Gate). Happy to discuss any questions here!
Dev tools · Jun 2026 · brew.sh
- PU
hope you enjoy
Life & fun · Jun 2026 · vorpus.github.io
- IM
Life & fun · Jun 2026 · hackernewstrends.com