Ingest, Enrich, and Analyze Network Flows at Scale
Riptide is an open-source telemetry engine that decodes enterprise network flow protocols, applies dynamic context metadata, and persists millions of records into ClickHouse for instant, real-time traffic analysis.
# Start the full Riptide stack (Ingest + ClickHouse + Grafana)
$ docker compose up -d
Creating network "riptide_default"
Creating volume "riptide_clickhouse_data"
Creating riptide-clickhouse ... done
Creating riptide-collector ... done
Creating riptide-grafana ... doneThe Real-Time Telemetry Pipeline
Watch flow records traverse the ingest, enrichment, and storage layers.
Engineered for Network Operations
Features designed to meet the performance and precision demands of NOC and ISP networks.
Multi-Protocol Ingestion
Native decoding for NetFlow v5, NetFlow v9, IPFIX (over UDP & TCP), and sFlow. Run multiple receivers simultaneously on configurable interfaces.
Asynchronous Enrichment Ladder
Adds interface descriptions, GeoIP locations, and AS routes without slowing ingest. Degrades gracefully to packet defaults if SNMP/external DNS fail.
Clock Skew Correction
Detects and corrects timestamps of exporters with misconfigured NTP clocks or broken sysUpTime math, safeguarding temporal consistency of log queries.
ClickHouse Row-Level Isolation
Multi-tenant design featuring row-level data segregation. Provision specific operator permissions and tenant boundaries natively through the CLI command.
Secured Credentials
Supports secure variable injection mechanisms (`vault://`, `sops://`, `env://`). Plaintext SNMP secrets are never exposed or saved in static properties.
Integrated Grafana Ecosystem
Shipped with standard Grafana template dashboards. Seamless integration for 95th percentile analysis, failure headroom, and deep interface traffic drilling.
Native MCP AI Server
Embedded Model Context Protocol (MCP) server running stdio IPC and HTTP/SSE. Protected by SecretRef tokens (env://, vault://, sops://) for direct LLM integration.
AI-Powered Network Telemetry & Automation
Riptide ships a native Java MCP server component and 7 pre-packaged Agent Skills directly inside the executable JAR for instant integration with AGY, Claude CLI, and custom AI agents.
Native Java Protocol Engine
Zero external Node.js or Python runtimes required. Runs directly inside riptide-flows-*.jar over standard input/output (stdio IPC) or HTTP Server-Sent Events (SSE).
- โก Stdio & SSE Transports โ Support for AGY / antigravity-cli and Claude CLI
- ๐ SecretRef Token Auth โ Resolves tokens via
env://,vault://, andsops:// - ๐ 1-Minute Rollup Router โ Auto-routes โฅ 60m queries to ClickHouse
SummingMergeTreeviews
7 Embedded Classpath Skills
Packaged under classpath*:mcp/skills/*.md and auto-discovered as MCP Prompts and Resources. Instant slash commands for autonomous network triage.
/riptide-investigate-ddos/riptide-cause-analysis/riptide-capacity-plan/riptide-peering-analysis/riptide-app-audit/riptide-trace-host/riptide-auto-mitigatePre-Packaged Network Engineering Skills
DDoS Mitigation Triage
/riptide-investigate-ddosScientific DDoS attack family classification grounded in RFC 4732, Shannon Entropy analysis (ฮH < -1.5), TCP flag histograms, and NIST SP 800-189 amplification heuristics.
Baseline Cause Analysis
/riptide-cause-analysisCompares current 15-minute traffic windows against 24-hour historical baselines to isolate root causes of sudden volumetric and protocol shifts.
Interface Capacity Analysis
/riptide-capacity-planEvaluates exporter interface bandwidth saturation against enriched SNMP interface speeds and projects 95th percentile link headroom.
Peering & Geo-IP Analysis
/riptide-peering-analysisQueries 1-minute rollups by Autonomous System Numbers (ASN) and country codes to optimize transit costs and IXP peering relationships.
Application Performance Triage
/riptide-app-auditAudits application protocol distribution, unclassified port traffic (application IS NULL), and public vs. private locality boundaries.
Host Forensic Investigation
/riptide-trace-hostForensic walk for target host IPs, detailing peer conversation matrices, active ports, flow durations, VLANs, and exporter interfaces.
Automated DDoS Mitigation
/riptide-auto-mitigateGenerates multi-tier mitigation rules emitting BGP FlowSpec (RFC 8955), RTBH null-routes (RFC 7999), iptables rules, and Cloud Scrubbing GRE redirection.
Built for Performance
Riptide leverages a modern JVM system architecture to process hundreds of thousands of network packets per second per node. Using lightweight event-driven networking and a decoupled asynchronous pipeline, telemetry collection stays fast and resource-efficient.
Deployment Options
Get Riptide running in your environment using your preferred method.
Deploy the full stack including Riptide, ClickHouse, and Grafana in seconds:
git clone https://github.com/Riptide-Labs/riptide.git
cd riptide/deployment/riptide
docker compose up -dDownload and install the latest packages. Installs a managed systemd service:
# For Debian/Ubuntu (.deb)
curl -LO https://github.com/Riptide-Labs/riptide/releases/download/v0.13.1/riptide_0.13.1_all.deb
sudo apt install ./riptide_0.13.1_all.deb
sudo systemctl enable --now riptide
# For RHEL/Rocky/Alma/Fedora (.rpm)
sudo dnf install https://github.com/Riptide-Labs/riptide/releases/download/v0.13.1/riptide-0.13.1-1.noarch.rpm
sudo systemctl enable --now riptideIntegrate Riptide declaratively into your NixOS configuration using the built-in module:
# In your NixOS configuration
services.riptide = {
enable = true;
settings = {
riptide.clickhouse.endpoint = "http://localhost:8123";
riptide.receivers.ipfix = { type = "ipfix"; host = "0.0.0.0"; port = 4739; };
};
};Run Riptide as a direct Java executable with native MCP AI Agent server enabled (requires Java 25):
cd target
java -jar riptide-flows-*.jar --riptide.mcp.enabled=true --riptide.mcp.transport=stdioOpen Source & Community Driven
Riptide is licensed under the GPL-3.0-or-later and welcomes contributions from network engineers, operators, and developers. Connect with us to discuss roadmap items or get configuration help.