Tink vs tcptrack
tcptrack is a libpcap TUI that lists live TCP connections like top. It is not a mechanic. Tink installs in one command, watches the Linux host, explains what is wrong, and helps you fix it.
tcptrack lists sockets. Tink answers “why is this VPS sick?”
Accidental sysadmins land on tcptrack because tcptrack -i eth0 shows ESTABLISHED rows without a dashboard. Then disk is at 91%, nginx dies, and last night's socket table does not say what to run. A filling /var is a Tink warning; it is not a tcptrack bitrate cell.
Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep using tcptrack if you already want a live TCP table on an SSH session. Use Tink if you run Linux servers and want a mechanic.
| Feature | Tink | tcptrack |
|---|---|---|
| Setup time | 30 seconds (one curl | sh command) | apt/yum install tcptrack, then tcptrack -i eth0 every time a socket looks busy |
| What you get | Working monitoring, diagnosis, and approved fixes | Live TCP rows: src/dst, state, and bitrate, only while the TUI is open |
| Pricing | Free (Scout) / $9 / $29 per machine per month | Open source. You still pay the person who SSHs in after the outage |
| Hidden costs | None — fully managed | Which interface to sniff, BPF filters, and whether anyone was watching when the flood started |
| Monitoring approach | Agent on the server — CPU, disk, services, logs, certs, ports | libpcap TCP table. tcptrack does not parse auth.log or propose a command |
| Configuration | None after install — heuristics and AI | Interface, filter expression, and whether you left tcptrack running in tmux |
| Plain-English diagnosis | Yes — AI explains root cause, impact, and fix | No — you read connection rows yourself |
| Fix execution | Proposes and executes approved commands with an audit trail | Monitoring only — tcptrack cannot drop the flood, restart nginx, or rotate a cert |
| Alerting | Built-in across 8 channels | None by default — tcptrack is a live table; paging is extra |
| Predictive alerts | Yes — disk fills in ~6 days, memory and CPU trends | Live sockets only — tcptrack does not forecast fill time or a quiet NIC going bad later |
| SSH brute-force detection | Built-in — parses auth.log every scan | Not included — tcptrack does not read host auth.log or journald |
| Machine offline detection | Agent presence monitoring with multi-channel alerts | If the host is down you cannot SSH into tcptrack either |
| Public status page | Shareable URL with 90-day history | Not included — tcptrack has no customer-facing status page |
| Weekly fleet digest | Automated Monday digest + daily brief when issues are open | Not included — a socket table is not a plain-English fleet narrative |
| On-call tracking | Built-in /oncall command + incident acknowledgment | Not included — wire something else into PagerDuty |
| Conversation interface | Telegram, WhatsApp, web dashboard, CLI | SSH + tcptrack. No mechanic you text when /var filled |
| Learning curve | None — works after install | Low to launch; higher to map an ESTABLISHED row to the process that filled the disk |
| Best for | Freelancers, small teams, accidental sysadmins (1-50 Linux servers) | Operators who already want a live TCP table and will still SSH in when the box is sick |
When tcptrack is the right choice
Keep using tcptrack when you already want that exact job:
- Live TCP table — you need ESTABLISHED src/dst rows, not a fleet digest.
- Connection-oriented — ifstat prints NICs; nethogs groups PIDs; tcptrack is the socket list.
- No extra service — a package on the box, not a hub, SaaS, or Telegram bot.
- No conversation layer wanted — some operators prefer a TUI and will never use a mechanic.
The real cost of “just run tcptrack”
The package is easy to install. A working ops loop for five Linux boxes is not:
- A complete socket table still means you SSH into the host and change the box by hand when it gets sick
- Host fill, nginx, certs, and SSH brute-force never appear unless you built extra checks
- A filling /var is a Tink disk warning on every scan — tcptrack stays a live table until you are looking
- A single VPS with nobody logged in still needs a mechanic, not another ESTABLISHED row
For a 5-server team, Tink Mechanic at $45/month is cheaper than the engineer who opens tcptrack after the outage, and every scan includes a diagnosis a quiet socket table will not type.
No SSH homework. No silent host. One command install.
Start MechanicAlso compare: Tink vs iftop · Tink vs ifstat · Tink vs nethogs