Microflow nano
Nano is a cross-architecture host traffic analyze super microprobe with extensive deployment experience. It can provide high-quality, fine-grained traffic log data for various data analysis platforms, enabling rich functionality and value.
- Nano is a cross-architecture basic data capability. **It is the world's smallest Linux tool of its kind.** - Nano is a **host-based**, high-performance, fine-grained, multi-dimensional traffic analyze tool, providing L4~L7 log output, real-time packet forwarding, and PCAP playback. - Nano is designed according to commercial product standards, featuring large-scale deployment and 24/7/365 operation capabilities, and has successfully deployed **over 18,000 VMs and K8S-nodes**. - Nano is a type o... The project is written primarily in PowerShell, first published in 2024. Key topics include: api-monitoring, api-performance, cloud-traffic-analysis, east-west-lateral-movement-attack-detection, host-based-traffic-analyzer.
Microflow Nano
<h2 style="font-size: 20px;color: #1E90FF;">Featherweight Probe. Heavyweight Security. </h3>🎬Brief Introduction
- Nano is a cross-architecture basic data capability. It is the world's smallest Linux tool of its kind.
- Nano is a host-based, high-performance, fine-grained, multi-dimensional traffic analyze tool, providing L4~L7 log output, real-time packet forwarding, and PCAP playback.
- Nano is designed according to commercial product standards, featuring large-scale deployment and 24/7/365 operation capabilities, and has successfully deployed over 18,000 VMs and K8S-nodes.
- Nano is a type of DaaS tool, and various data analysis platforms can realize rich cloud network security, data security, and performance monitoring scenarios through Nano data.
🚀 Key Features
- Ultra-Lightweight: Just 500KB standalone Linux tool, yet incredibly powerful.
- Cross-Platform: Works on Linux, Windows Server (above 2008); ARM86, X86; K8S & containers.
- Ultra-High Performance: Without additional CPU resources, fixed 110MB memory footprint.
- Fine-grained Data: Output HTTP/header/body, SQL, DNS, TCP/UDP......,raw packets, and host metrics.
- Superior Security: Fully silent deployment, with no interference to business, hosts, or cloud networks.
💡 Adaptation platform
- ELK/ES, Splunk, Graylog, OpenSearch;
- AWS Cloudwatch/Log, AZURE Monitor/Log Analytics; Datadog/Log Management, New Relic/Logs;
- SOC/XDR platforms, Wazuh, QRadar, etc...
🎯 Use Cases

🚦 Simplified Deployment
📊Output List
📺Demo
We have built a demo using Graylog to help you understand the powerful capabilities of Nano. We are very grateful to Graylog.
Demo Login:guest PS:mfnano@2024
☎FAQ
🏆 Battle-Tested Reliability
- Developed since 2019, now in version 4.0
- Deployed on 1000+ IaaS Server and 18,000+ PaaS VMs/K8S nodes
💰 Free and Open Source
| User Type | Plan |
|---|---|
| Individuals | Free Forever |
| Education | Free Forever |
| SMBs | Free Forever |
| Medium to Large Users | Commercially licensed, but open source |
07/23/2023
Contributors
Showing top 2 contributors by commit count.
