This guide walks you through launching Oryx, selecting a network interface, configuring protocol filters, and navigating the TUI sections. By the end you’ll have live packet capture running and know how to move between the inspection, firewall, statistics, metrics, and alerts views.Documentation Index
Fetch the complete documentation index at: https://mintlify.com/pythops/oryx/llms.txt
Use this file to discover all available pages before exploring further.
Start Oryx
Launch Oryx
Run the following command to start Oryx:Oryx opens to the filter selection screen, where you choose which interface and protocols to capture.
Select a network interface
Use the arrow keys (
j / k or Down / Up) to highlight a network interface, then press Space to select it. You can select multiple interfaces.Choose protocols to capture
Move between the transport, network, and link layer filter panels using Tab. Press Space to select or deselect individual protocols. To capture everything, leave all protocols selected.The available protocols are:
| Layer | Protocols |
|---|---|
| Transport | TCP, UDP, SCTP |
| Network | IPv4, IPv6, ICMPv4, ICMPv6, IGMP |
| Link | ARP |
Apply your filters
Press f to apply the selected filters and start capturing traffic. Oryx attaches its eBPF programs to the chosen interfaces and begins streaming packets.
Navigate the TUI sections
Use Tab or Shift+Tab to switch between the five main sections:
- Inspection — live packet table with source/destination, protocol, and port
- Firewall — create and toggle eBPF firewall rules
- Stats — protocol breakdowns, bandwidth, and top-10 addresses
- Metrics — custom port-range traffic counters
- Alerts — threat detection events such as SYN flood warnings
Launch with flags
You can skip the interactive filter screen by passing interface and protocol options directly on the command line. This is useful for scripting or when you already know exactly what you want to capture.| Flag | Short | Values | Default |
|---|---|---|---|
--interface | -i | Any valid network interface name | — |
--transport | -t | tcp, udp, sctp, all | all |
--network | -n | ipv4, ipv6, icmpv4, icmpv6, igmp, all | all |
--link | -l | arp, all | all |
--direction | -d | ingress, egress, all | all |
oryx --help to see the full usage reference.
What to expect
Once filters are applied, the Inspection section shows a scrolling packet table. Each row includes:- Source address and source port
- Destination address and destination port
- Protocol (TCP, UDP, SCTP, ICMPv4, ICMPv6, IGMP, or ARP)
- Process ID (PID) — shown for egress packets where attribution is possible;
-otherwise
Next steps
Key bindings
Full reference for every keyboard shortcut in Oryx.
Firewall
Block traffic by IP, port, and direction with persistent rules.
Filters
Learn how transport, network, and link layer filters interact.
Export
Save your capture to a file for offline analysis.