Tink vs jnettop
jnettop is a Linux console traffic capture that groups packets into host-to-host streams. It is not a mechanic. Tink installs in one command, watches the Linux host, explains what is wrong, and helps you fix it.
jnettop ranks the stream. Tink answers “why is this VPS sick?”
Accidental sysadmins land on jnettop because a local/remote table fits an SSH session and jnettop -i eth0 needs no dashboard. Then disk is at 91%, nginx dies, and last night's stream ranking does not say what to run. A filling /var is a Tink warning; it is not a jnettop bitrate.
Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep using jnettop if you already want a live connection-stream TUI on an SSH session. Use Tink if you run Linux servers and want a mechanic.
| Feature | Tink | jnettop |
|---|---|---|
| Setup time | 30 seconds (one curl | sh command) | apt/yum install jnettop, pick -i and a filter, then stay SSH'd in watching streams |
| What you get | Working monitoring, diagnosis, and approved fixes | A curses table of host pairs and bitrates — you still decide if that stream is backup, abuse, or a stuck rsync |
| Pricing | Free (Scout) / $9 / $29 per machine per month | Open source. You still pay the person who is logged in when the NIC saturates |
| Hidden costs | None — fully managed | CAP_NET_RAW, the right interface name, a filter you remember, and no pager unless you wrap it |
| Monitoring approach | Agent on the server — CPU, disk, services, logs, certs, ports | Interactive TUI on one NIC. jnettop does not parse auth.log or propose a command |
| Configuration | None after install — heuristics and AI | Interface, aggregation, display filter, and whether DNS lookups stall the TUI |
| Plain-English diagnosis | Yes — AI explains root cause, impact, and fix | No — you read local/remote columns and a bitrate yourself |
| Fix execution | Proposes and executes approved commands with an audit trail | Monitoring only — jnettop cannot stop a backup, restart nginx, or rotate a cert |
| Alerting | Built-in across 8 channels | None by default — jnettop draws a screen; paging is extra |
| Predictive alerts | Yes — disk fills in ~6 days, memory and CPU trends | Live snapshot only — jnettop forgets the stream when you quit |
| SSH brute-force detection | Built-in — parses auth.log every scan | Not included — a flood of port-22 streams is not "Invalid user" from auth.log |
| Machine offline detection | Agent presence monitoring with multi-channel alerts | If the host is down you cannot SSH into jnettop either |
| Public status page | Shareable URL with 90-day history | Not included — jnettop has no customer-facing status page |
| Weekly fleet digest | Automated Monday digest + daily brief when issues are open | Not included — a remembered stream table is not a plain-English fleet narrative |
| On-call tracking | Built-in /oncall command + incident acknowledgment | Not included — wire something else into PagerDuty |
| Conversation interface | Telegram, WhatsApp, web dashboard, CLI | SSH + a curses TUI. No mechanic you text when the uplink is full |
| Learning curve | None — works after install | Low to launch; higher to map a remote IP back to the process that opened the socket |
| Best for | Freelancers, small teams, accidental sysadmins (1-50 Linux servers) | Operators already SSH'd in who want a live host-to-host stream ranking on that NIC |
When jnettop is the right choice
Keep using jnettop when you already want that exact job:
- Connection-oriented — ifstat prints NICs; nethogs groups PIDs; jnettop ranks host-to-host streams.
- Live capture — you want libpcap on this interface, not a historical vnstat total.
- No extra service — a package on the box, not a hub, SaaS, or Telegram bot.
- No conversation layer wanted — some operators prefer a stream table and will never use a mechanic.
The real cost of “just run jnettop”
The package is easy to install. A working ops loop for five Linux boxes is not:
- A complete stream table still means you SSH into the host and change the box by hand when it gets sick
- Host fill, nginx, certs, and SSH brute-force never appear unless you built extra checks
- A filling /var is a Tink disk warning on every scan — jnettop stays a packet TUI until you are looking
- A single VPS with nobody logged in still needs a mechanic, not another host-pair ranking
For a 5-server team, Tink Mechanic at $45/month is cheaper than the engineer who opens jnettop after the outage, and every scan includes a diagnosis a quiet stream table will not type.
No SSH homework. No silent host. One command install.
Start MechanicAlso compare: Tink vs iftop · Tink vs nethogs · Tink vs ifstat