Very lightweight NixOS router/server flow data collector

StepBroBD · March 17, 2026, 8:09am

TC based ingress/egress flow tagging, go for userspace and prometheus exporter handling

i’m running this on a couple 1 core 1 g ram VPS box with 1 bgp session and a couple more powerful ones

can achieve 80% what those big libpcap based solutions with a lot less resource use

config example

modules/nixos/prometheus.nix

ba1c29b7f


      
          
          { config, ... }:
          
          let
            inherit (lib) /* mkIf */ toString;
          
            cfg = config.services.prometheus;
          in
          {
            config = /* mkIf cfg.enable */ {
              services.rfm = {
                enable = true;
                settings.agent = {
                  interfaces = [ "*" ];
                  bpf.sample_rate = 10;
                  prometheus.host = "127.0.0.1";
                  prometheus.port = 9669;
                  enrich.mmdb.asn_db = "${config.services.geoipupdate.settings.DatabaseDirectory}/GeoLite2-ASN.mmdb";
                  enrich.mmdb.city_db = "${config.services.geoipupdate.settings.DatabaseDirectory}/GeoLite2-City.mmdb";
                  # only enable rib on routers
                  # enrich.rib.bmp.host = "127.0.0.1";

mightyiam · March 18, 2026, 1:50pm

Thank you for sharing! How about the story behind? Why’d you make it?

StepBroBD · March 18, 2026, 2:59pm

its mostly because i have a couple small vps machine with a couple providers with bgp sessions, and i want to track the network activities on those machines without everything getting oom’ed

the existing solutions are very chunky (maybe not so for big providers) but for a small 1/2 core 1/2 ram machines its certainly not feasible to run kafka, clickhouse, and a flow collector along with 1/2 upstreams receiving/exporting full tables… since i already use prometheus grafana stack everywhere, why not just make a clone (in terms of the features i wanted) and lightweight flow collector that matches my need

StepBroBD · March 18, 2026, 11:04pm

it now has basically ipfix flow export

tested with cloudflare magic network monitoring