What hardware does Xenoeye require to run?

The tool can run on a VM with one CPU and 1GB of RAM, or on devices like Orange Pi with 4GB of memory. Performance testing showed roughly 700K flows per second per single CPU in production mode with multiple monitoring objects and sliding windows.

What protocols does Xenoeye support?

The collector supports Netflow v9, IPFIX, Netflow v5, and sFlow. The developers have tested Netflow v9 and IPFIX in their own networks.

How is this tool licensed and distributed?

Xenoeye uses a liberal ISC license with no hidden or artificial restrictions, and the developers have no plans to create commercial or semi-commercial versions. The v25.02 release includes an LXC container image and a Proxmox template for easy deployment.

Open-Source AIHacker NewsJun 29, 2026Jun 30, 2026, 06:00 JST1 min read

Xenoeye: Open-source network traffic analyzer using Netflow, PostgreSQL, Grafana

Send on LINE

Key takeaway

Xenoeye is an open-source network traffic analyzer that collects flow data from routers using standard protocols (Netflow, IPFIX, sFlow) and stores it in PostgreSQL for analysis and charting in Grafana.
It runs on minimal hardware and helps organizations detect traffic anomalies, DDoS attacks, and network patterns without requiring proprietary or AI-based tools.

3 Key Points

What happened
A lightweight network monitoring tool called Xenoeye was released that collects and analyzes network traffic data from Netflow, IPFIX, and sFlow protocols. The tool aggregates traffic by IP networks, individual addresses, or services, and stores data in PostgreSQL for visualization in Grafana dashboards.
Why it matters
The tool can run on minimal hardware—a single CPU with 1GB of RAM or even on devices like Orange Pi—making it accessible for medium to large networks without expensive infrastructure. Organizations can detect traffic spikes, drops, and potential DDoS attacks using moving averages and threshold-based alerts.
What to watch
The project uses an ISC license with no commercial restrictions and has no planned commercial version. The v25.02 release includes a ready-to-deploy LXC container image with pre-configured PostgreSQL and Grafana dashboards for IPv4 and IPv6 monitoring. Performance testing on an i3-2120 CPU showed roughly 700K flows per second in production-mode configurations.

Ask the AI about this article →

Summaries like this, in your inbox every morning.

Get news like this every morning — free

FAQ

What hardware does Xenoeye require to run?: The tool can run on a VM with one CPU and 1GB of RAM, or on devices like Orange Pi with 4GB of memory. Performance testing showed roughly 700K flows per second per single CPU in production mode with multiple monitoring objects and sliding windows.
What protocols does Xenoeye support?: The collector supports Netflow v9, IPFIX, Netflow v5, and sFlow. The developers have tested Netflow v9 and IPFIX in their own networks.
How is this tool licensed and distributed?: Xenoeye uses a liberal ISC license with no hidden or artificial restrictions, and the developers have no plans to create commercial or semi-commercial versions. The v25.02 release includes an LXC container image and a Proxmox template for easy deployment.

Hacker NewsRead Original Article

Send on LINE

Get the latest Open-Source AI news every morning

For example, today's edition would include:

DataAgent launches with $10M to auto-fix Kubernetes faultsSiliconANGLE AI · 5h ago
Z.ai runs GLM on 100,000 Chinese AI chipsDIGITIMES Asia · 8h ago
Broadcom Unveils VMware AI Factory for Faster Private AITop Companies AI · 18h ago

AI-summarized, only the topics you pick — one digest a day via Email, Slack, or Discord.

Subscribe free →

Free · takes 30 seconds · unsubscribe anytimeWhat is AIToday? →