Web Interface
flowwler-web is an optional browser interface for flowwler. It proxies the REST API and has no dependencies beyond the flowwler daemon itself.
Functions
| Function | Description |
|---|---|
| Dashboard | Daemon status, active mitigation count, BGP peer states, flow exporter health, recent attacks, and the top-10 targets by inbound traffic |
| Analyze IP | IP lookup (IP + rank-by metric) showing group membership, matched subnet, escalation policy, and live FlowSpec rule suggestions derived from current flow data. Also shows a standalone Top Targets table (top-20 by inbound traffic), filterable by group. |
| Attack history | Recorded attacks with aggregate stats (total count, mean duration, peak BPS/PPS, top victims and groups). Filterable by group, victim IP, or active-only, with prev/next pagination. Each attack links to a full event timeline with the FlowSpec rules and rule suggestions present at each state transition, plus a PCAP download when a capture was taken. |
| Mitigations | Active auto-managed and manual mitigations, plus all currently announced FlowSpec rules. New mitigations can be created manually via a form that supports blackhole, subnet-blackhole, and FlowSpec types, with an optional BGP community (standard or large format). FlowSpec rules accept a victim IP, an action (discard, rate-limit, or redirect — with next-hop and/or VRF route target), and optional source IP, protocol/port, and packet-length filters. When the API returns FlowSpec rule suggestions, they appear as a dismissible card with one-click Apply buttons that pre-fill the form. |
| Groups | Per-group traffic: inbound, outbound, and discard rates per IP; named rules with their match criteria (protocol, ports, TCP flags, fragments, packet length, and subnet-level carpet-bomb config); active victims and escalation levels, including aggregated subnet-level escalations; FlowSpec rules; prefix sources; force-clear per victim |
| Captures | Active per-attack PCAP capture sessions, manual ad-hoc captures (start/stop for any victim IP), and attack-linked PCAP files with size, packet count, a decoded packet preview, and download. Only shown in the sidebar when PCAP capture is enabled in the daemon config. |
| Flow exporters | Liveness and sampling rate per NetFlow/sFlow router |
| BGP | Peer states and full RIB (IPv4/IPv6 unicast and FlowSpec) |
| Notifications | Status and last-fired time per notification target; test dispatch |
| Whitelist | Configured whitelist scopes (global and per-group overrides) with their resolved CIDR prefix lists, expandable per scope |
| Config | Read-only view of the running configuration with buttons to trigger a full config reload or an external prefix sources refresh |
Installation
sudo apt install flowwler-web
The package installs the following:
| Path | Description |
|---|---|
/usr/bin/flowwler-web |
Binary |
/lib/systemd/system/flowwler-web.service |
systemd unit |
/etc/default/flowwler-web |
Environment file |
The flowwler system user is shared with the flowwler daemon if both packages are installed.
Edit /etc/default/flowwler-web to configure the service, then enable and start it:
sudo systemctl enable --now flowwler-web
Configuration
All flags can be set via environment variables. The Debian package writes these into /etc/default/flowwler-web, which the systemd unit loads automatically.
| Flag | Env var | Default | Description |
|---|---|---|---|
--listen |
FLOWWLER_LISTEN |
:8080 |
Address to listen on |
--api-url |
FLOWWLER_API_URL |
http://localhost:9731 |
flowwler API base URL |
--api-key |
FLOWWLER_API_KEY |
- | API key forwarded as X-API-Key |
--username |
FLOWWLER_USERNAME |
- | HTTP Basic Auth username |
--password |
FLOWWLER_PASSWORD |
- | HTTP Basic Auth password |
If the flowwler API has authentication enabled (see REST API - Authentication), supply credentials via --api-key or --username/--password. Unauthenticated requests are sent if neither is set.
flowwler-web has no authentication layer of its own. Place it behind a reverse proxy with TLS and access control if exposed beyond localhost.