Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/pythops/oryx/llms.txt

Use this file to discover all available pages before exploring further.

The Inspection section is Oryx’s primary view, showing a live scrolling table of every packet captured on the selected interface. Each row is updated in real time as packets arrive, giving you a continuous stream of network activity without any manual refresh.

​
Packet table columns

The table displays six columns for each captured packet:
ColumnDescription
Source AddressSource IP address (or MAC address for ARP packets)
Source PortSource port number; - for protocols without ports (ICMPv4, ICMPv6, IGMP, ARP)
Destination AddressDestination IP address (or MAC address for ARP packets)
Destination PortDestination port number; - for protocols without ports
ProtocolOne of: TCP, UDP, SCTP, ICMPv4, ICMPv6, IGMP, ARP
PidProcess ID associated with the connection, or - if not resolvable
The Pid column relies on process attribution via socket lookups. It displays a - when the kernel cannot associate the packet with a specific process — for example on ICMP or ARP traffic.

​
Scrolling and manual scroll mode

By default, the table auto-scrolls to follow the latest arriving packet. When you move the cursor, Oryx enters manual scroll mode, indicated by a scroll icon in the header row.
KeyAction
j or DownScroll down one row
k or UpScroll up one row
EscExit manual scroll mode and resume auto-scroll
While in manual scroll mode, new packets continue to be captured in the background — you are just viewing a fixed window of the history.

​
Packet details popup

Press i on any selected packet to open a Packet Infos popup that shows the full decoded header fields for that packet. The popup renders two sections:
  • Ethernet frame header — source and destination MAC addresses, EtherType
  • IP / protocol details — for IP packets, this shows the full IPv4 or IPv6 header fields plus the inner protocol (TCP, UDP, SCTP, ICMP, or IGMP) header fields. For ARP packets, the ARP header fields are shown alongside the Ethernet frame.
Press Esc to close the popup.
The popup can only be opened when at least one packet is visible in the current view — either from the full packet list or from a filtered fuzzy search result set.
Press / to activate fuzzy search. A Search input bar appears at the bottom of the Inspection section.
1

Enable search

Press /. The search bar turns green and accepts keyboard input immediately.
2

Type a filter

Start typing any string — an IP address, port number, protocol name, or PID. Matching packets are highlighted and the list is filtered in real time.
3

Pause to scroll

Press Esc once to pause the search input (the bar turns yellow). You can now use j/k to scroll through filtered results without losing your search term.
4

Resume typing

Press / again while paused to reactivate the input field and continue refining your search.
5

Exit search

Press Esc a second time (while paused) to fully disable fuzzy search and return to the unfiltered live view.
Fuzzy search operates on the in-memory packet buffer. It does not drop packets — new packets continue to accumulate while you search.

​
Exporting packets

Press s in the Inspection section to export all captured packets to a timestamped file in ~/oryx/. See Exporting captured packets to file for details.

Build docs developers (and LLMs) love

Get started for freeTalk to us