Live Network Connections

Plugin: network-viewer.plugin Module: network-viewer

Overview

Map application dependencies on a host. The network-viewer plugin reads the kernel's live socket table and draws which local process talks to which, and which remote endpoints they reach. On Linux it also attributes each process to the container, image, systemd unit, or Kubernetes pod, namespace, and workload that owns it, as far as the APPS_LOOKUP data allows — attribution is best effort, and a process it cannot resolve is still drawn.

The network-viewer plugin builds the topology:network-connections view directly from the host's live socket table, with no SNMP and no instrumentation. It is available on Linux, FreeBSD, and macOS; container and Kubernetes attribution is Linux-only.

This integration is only supported on the following platforms:

• Linux
• FreeBSD
• macOS

This integration runs as a single instance per Netdata Agent.

The plugin needs privileged access to enumerate the sockets of every process; standard installations grant it. In a container it additionally needs the host network namespace, the host /proc, SYS_ADMIN for sibling containers, and SYS_PTRACE to attribute connections to processes. On macOS a non-privileged or TCC-restricted run omits protected processes; grant Full Disk Access where local policy requires it. The Function itself requires a signed-in Netdata identity in the same Space with permission to view sensitive data — it is not available anonymously.

Default Behavior

Auto-Detection

Always on; observes the host's live network connections.

Limits

A single response is capped at 64 MiB. On a host with enough connections to exceed that, the request is aborted rather than truncated — group the map (by process name or container) to bring it back under the cap.

Performance Impact

Sockets are enumerated when the Function is called, not continuously in the background, so the cost is paid per request and scales with the number of open sockets and processes.

Setup

Prerequisites

Privileged access to the socket tables

The plugin needs its normal privileged permissions to enumerate the sockets of every process. Standard installations grant these. A container needs the host network namespace and the host /proc to see anything beyond its own sockets, SYS_ADMIN to reach sibling containers' connections, and SYS_PTRACE to attribute connections to processes — without SYS_PTRACE the connections are still listed but not tied to the processes that own them. On macOS, a non-privileged or TCC-restricted run silently omits protected processes.

Configuration

Options

The Function is always available and needs no setup. The only setting is the size of the per-PID APPS_LOOKUP cache, which holds the cgroup identity already resolved for each process; raising it does not make more processes resolvable, it only keeps more resolved ones cached.

Config options

Option	Description	Default	Required
apps lookup cache size	Maximum number of per-PID APPS_LOOKUP cache entries kept by network-viewer.plugin.	8192	no

via File

The configuration file name for this integration is netdata.conf. Configuration for this specific integration is located in the [plugin:network-viewer] section within that file.

The file format is a modified INI syntax. The general structure is:

[section1]
    option1 = some value
    option2 = some other value

[section2]
    option3 = some third value

You can edit the configuration file using the edit-config script from the Netdata config directory.

cd /etc/netdata 2>/dev/null || cd /opt/netdata/etc/netdata
sudo ./edit-config netdata.conf

Examples

There are no configuration examples.

Alerts

There are no alerts configured by default for this integration.

Metrics