Real-time monitoring

See the attack live, not just the bill.

A real-time dashboard for each server: packets passed and blocked, GeoIP world map, top source IPs, top ports and protocol breakdown. You see what's hitting your machine: where it comes from, which port it targets, and how much PAKKT absorbs.

Free 7-day trial See a real attack
30 s
refresh rate
GeoIP
per source IP
0
packet capture
app.pakkt.io/dashboard · srv-fr-gaming-01 ● LIVE
Total visibility

All your traffic, read at a glance.

The dashboard splits your traffic by port, source IP, country and protocol, so you can spot an attack before you've even created the rule that blocks it.

GeoIP world map

One bubble per source country, colored by its block rate. The arcs converge toward your agent. You see where the flood comes from, and what's already neutralized.

<10% · legitimate 10–50% · mixed >50% · attack

Passed vs blocked

Four counters up top: packets and volume delivered to the server, packets and volume dropped upstream. The chart overlays both curves over 24 h.

Top IPs, ports, protocols

The most active source IPs, the busiest ports, the TCP / UDP / ICMP breakdown. A blacklist button per IP, right from the list.

Two pipelines, zero blind spots

Observe ≠ act. We measure both.

PAKKT strictly separates "which traffic arrives on the machine" from "what my rules did." You spot a surge on an arbitrary port before you have a dedicated rule, then you measure the effectiveness of each rule once it's in place.

  • ▸Passive observation: an eBPF tracker captures all traffic by port, even without a rule. This is what populates the top ports and top IPs.
  • ▸Rule effectiveness: per-rule XDP and nftables stats answer "how much did my rule X pass / drop," with no approximate aggregation.
  • ▸Attribution: each blocked IP can be expanded to see which rule dropped it.
Metrics pipeline
eBPF
Maps drained by the agent
ip_tracker · port_tracker · per-rule stats
mTLS
Heartbeat every 30 s
aggregated counters only, never any payload
7 d
TimescaleDB, 7-day retention
compressed hypertables, 10 m / 1 h / 24 h windows
Keep going

Explore the platform

XDP + nftables rules Two independent kernel layers, one panel. Discover → Auto Shield Automatic attack detection and IP banning. Discover → Geo-blocking Allow or block traffic by country, via CIDR sets. Discover → Proven effectiveness The same attack, with and without PAKKT. Discover →
FAQ

Frequently asked questions

Straight answers, no marketing fog.

How often is the dashboard updated? expand_more
The dashboard refreshes every 30 seconds, in step with the agent heartbeat. On each cycle, the agent drains the eBPF map counters (packets passed, blocked, per port, top IPs) and sends them to the PAKKT backend over mTLS. So you see the real state of your traffic to within 30 seconds, with nothing to refresh manually.
Does the monitoring capture the content of my traffic? expand_more
No. PAKKT captures no packets and stores no payload. The agent only sends aggregated counters: the number of packets passed and blocked, totals per port, and source IPs ranked by volume. No payload and no application data ever leaves your server.
What do the bubble colors on the world map mean? expand_more
Each bubble represents a source country, and its color describes the block rate observed for that country: green below 10% drop (mostly legitimate traffic), amber between 10 and 50% (mixed traffic to keep an eye on), red above 50% (mostly blocked source, typically an attack origin). The color therefore describes the level of blocking, not a verdict on legitimacy.
How long are metrics retained? expand_more
Metrics are retained for 7 days in TimescaleDB hypertables, with automatic compression. The dashboard covers 10-minute, 1-hour and 24-hour windows. This short retention keeps the database lightweight and respects the principle of data minimization.
What is the "pkkt" unit shown everywhere? expand_more
"pkkt" is PAKKT's own packet unit (for example "1.2K pkkt"). It counts the network packets processed by the engine, whether passed or blocked. The associated volume is expressed in bytes (KB, MB, GB, TB).

Plug in an agent, watch the traffic.

From 3 € / server / month. One-command install, live dashboard in under 60 seconds. Free 7-day trial, no credit card.

See my traffic See protection rules