TUI for sniffing network traffic using eBPF

📸 Demo

✨ Features

• Real-time traffic inspection and visualization.
• Comprehensive Traffic Statistics.
• Firewall functionalities.
• Fuzzy search.

💡 Prerequisites

A Linux based OS.

Note

You might need to install nerdfonts for the icons to be displayed correctly.

🚀 Installation

📥 Binary release

You can download the pre-built binaries from the release page release page

🐧Arch Linux

You can install oryx from the AUR with using an AUR helper.

paru -S oryx

⚒️ Build from source

To build oryx:

1. Install Rust nightly toolchain

rustup toolchain install nightly --component rust-src

2. Install bpf-linker

For x86_64

Simply run the following command:

cargo install bpf-linker

For arm64

For Debian based distributions, make sure you have the following dependencies installed:

• llvm-19
• llvm-19-dev
• libpolly-19-dev

then run the following command:

cargo install bpf-linker --no-default-features

Check bpf-linker Installation section for more infos.

3. Build

cargo xtask build --release

This will produce an executable file at target/release/oryx that you can copy to a directory in your $PATH.

🪄 Usage

Run the following command to start oryx:

sudo oryx

⌨️ Key Bindings

?: Show help.

Tab or Shift + Tab: Switch between different sections.

j or Down : Scroll down.

k or Up: Scroll up.

esc: Dismiss the different pop-ups and modes.

q or ctrl + c: Quit the app.

Space: Select/Deselect interface or filter.

f: Update the applied filters.

ctrl + r: Reset the app.

ctrl + s: Export the capture to ~/oryx/capture file.

Inspection Section

i: Show more infos about the selected packet.

/: Start fuzzy search.

Firewall Section

Space: Toggle firewall rules status.

n : Add new firewall rule.

e: Edit a firewall rule.

s: Save firewall rules to ~/oryx/firewall.json

Enter: Create or Save a firewall rule.

⚖️ License

GPLv3