Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/pythops/oryx/llms.txt

Use this file to discover all available pages before exploring further.

The Stats section provides a high-level overview of traffic across four areas: bandwidth usage, transport layer protocol breakdown, network layer protocol breakdown, and top egress destinations. All statistics are derived from the same live packet stream that feeds the Inspection section, updated continuously in a background thread every 500 ms.

Bandwidth charts

The top half of the Stats section shows two line charts side by side:
  • Incoming — bytes received on the selected network interface per second
  • Outgoing — bytes sent on the selected network interface per second
Oryx reads raw byte counters from /proc/net/dev, polling once per second. The Y-axis label automatically scales the unit based on the current peak value:
RangeUnit displayed
Below 1024 KBKB
1024 KB – 1024 MBMB
1024 MB and aboveGB
The chart keeps a rolling window of the last 20 seconds of data. The X-axis spans 0 to 20 seconds with labels at 0, 5, 10, 15, and 20.

Protocol breakdown charts

The bottom half of the Stats section contains three vertical bar charts, each showing protocol share as a percentage of total captured packets.

Transport layer

Displays the proportion of packets for each transport and upper-network protocol:
  • TCP
  • UDP
  • SCTP
  • ICMPv4
  • ICMPv6
  • IGMP

Network layer

Displays the proportion of IP version usage:
  • IPv4
  • IPv6
Displays the proportion of link-layer protocols:
  • ARP
Each bar shows its current percentage value. All three charts share the same 0–100% scale.

Top visited websites

On the left of the protocol charts, a horizontal bar chart shows the top 10 egress destination addresses by packet count. Oryx attempts a reverse DNS lookup for each destination IP address and displays the resolved hostname when available. If no hostname can be resolved, the raw IP address is shown.
Only egress (outgoing) packets contribute to the top visited websites chart. Ingress packets are counted for protocol statistics but not for destination address tracking.

Update interval

Protocol statistics and address counts are updated in a background thread that wakes every 500 ms and processes any packets received since the last iteration. Bandwidth data updates independently on a 1-second poll of /proc/net/dev.

Build docs developers (and LLMs) love