What operating systems does Tink support?

Any Linux distribution with curl and Node.js 20 or newer. The installer uses a user-local command and does not require systemd or root access.

Does Tink run commands automatically?

No. Tink suggests fixes and waits for your explicit approval. Nothing runs without you confirming it first.

How much resources does the Tink agent use?

Minimal. The agent idles at under 20MB RAM and near-zero CPU between scans. Scans themselves take a few seconds.

Can I use Tink on containers?

Tink is designed for long-running servers, not ephemeral containers. For Kubernetes, point it at your nodes instead.

What data does Tink collect?

System metrics (CPU, memory, disk, network), running services, and relevant log snippets when diagnosing issues. No application data, credentials, or file contents.

Tink vs iptraf

iptraf-ng is a curses IP LAN monitor. It counts TCP, UDP, and LAN stations on one host right now. It is not a mechanic. Tink installs in one command, watches the Linux host, explains what is wrong, and helps you fix it.

iptraf counts the packets. Tink answers “why is this VPS sick?”

Accidental sysadmins land on iptraf because sudo iptraf-ng is a familiar answer for a busy NIC. Then disk is at 91%, nginx dies, and nobody is in the TUI — no sentence that says what to run. A filling /var is a Tink warning; it is invisible to iptraf until you SSH and pick the wrong interface.

Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep using iptraf if you already want live TCP/UDP counts on an SSH session. Use Tink if you run Linux servers and want a mechanic.

Feature	Tink	iptraf
Setup time	30 seconds (one curl \| sh command)	apt/yum install iptraf-ng, pick IP traffic monitor vs interface stats, then stay SSH'd in as root
What you get	Working monitoring, diagnosis, and approved fixes	A curses IP LAN monitor — you still decide if that TCP count is backup, abuse, or a stuck rsync
Pricing	Free (Scout) / $9 / $29 per machine per month	Open source. You still pay the person who is logged in when the NIC saturates
Hidden costs	None — fully managed	Root, the right interface, a filter you remember, and no pager unless you wrap it
Monitoring approach	Agent on the server — CPU, disk, services, logs, certs, ports	Interactive TUI on one host. iptraf does not parse auth.log or propose a command
Configuration	None after install — heuristics and AI	Interface, promiscuous mode, TCP/UDP filters, and which screen (traffic, LAN station, detailed stats)
Plain-English diagnosis	Yes — AI explains root cause, impact, and fix	No — you read packet counts and byte totals yourself
Fix execution	Proposes and executes approved commands with an audit trail	Monitoring only — iptraf cannot stop a backup, restart nginx, or rotate a cert
Alerting	Built-in across 8 channels	None by default — iptraf draws a screen; paging is extra
Predictive alerts	Yes — disk fills in ~6 days, memory and CPU trends	Live snapshot only — iptraf forgets the session when you quit
SSH brute-force detection	Built-in — parses auth.log every scan	Not included — a flood of port-22 packets is not "Invalid user" from auth.log
Machine offline detection	Agent presence monitoring with multi-channel alerts	If the host is down you cannot SSH into iptraf either
Public status page	Shareable URL with 90-day history	Not included — iptraf has no customer-facing status page
Weekly fleet digest	Automated Monday digest + daily brief when issues are open	Not included — a remembered packet count is not a plain-English fleet narrative
On-call tracking	Built-in /oncall command + incident acknowledgment	Not included — wire something else into PagerDuty
Conversation interface	Telegram, WhatsApp, web dashboard, CLI	SSH + a curses TUI. No mechanic you text when the uplink is full
Learning curve	None — works after install	Low to launch; higher to map a TCP count back to the process that opened the socket
Best for	Freelancers, small teams, accidental sysadmins (1-50 Linux servers)	Operators already SSH'd in who want live IP/TCP/UDP counts on that host

When iptraf is the right choice

Keep using iptraf when you already want that exact job:

Live IP traffic counts — you are already SSH'd in and need TCP/UDP/ICMP totals on this host right now.
LAN station monitor — MAC-level talkers on a segment, not a fleet diagnosis.
No extra service — a package on the box, not a hub, SaaS, or Telegram bot.
No conversation layer wanted — some operators prefer a TUI and will never use a mechanic.

The real cost of “just run iptraf”

The package is easy to install. A working ops loop for five Linux boxes is not:

A healthy TUI still means you SSH into the host and change the box by hand when it gets sick
Host fill, nginx, certs, and SSH brute-force never appear unless you built extra checks
A filling /var is a Tink disk warning on every scan — iptraf stays a packet counter until you are looking
A single VPS with nobody logged in still needs a mechanic, not another curses session

For a 5-server team, Tink Mechanic at $45/month is cheaper than the engineer who opens iptraf after the uplink is already full, and every scan includes a diagnosis a quiet TUI will not type.

No SSH homework. No silent host. One command install.

Start Mechanic

Also compare: Tink vs iftop · Tink vs nethogs · Tink vs nload