Frequently asked questions
What it is and isn’t
Section titled “What it is and isn’t”Is CaudalGhost a firewall?
Section titled “Is CaudalGhost a firewall?”No. It doesn’t block or control traffic — it only measures it and makes it visible. Blocking or allowing connections is a firewall’s job (a different category); CaudalGhost does the opposite: it informs you, without interfering.
Does it only show the current moment, or does it keep history too?
Section titled “Does it only show the current moment, or does it keep history too?”Both: alongside the live view, CaudalGhost keeps history (which never expires) and resolves the hostnames of remote servers, so you can look back weeks or months — not just the current instant.
Does it capture my traffic or what I send?
Section titled “Does it capture my traffic or what I send?”No. It only logs metadata: how many bytes, when, which app, and to what domain. Never the content itself. See Privacy and data.
Measurement
Section titled “Measurement”Why does a brief spike look lower than on other meters?
Section titled “Why does a brief spike look lower than on other meters?”That’s by design, not a bug. CaudalGhost’s live data is sampled roughly every 1 second, so what you see is the actual throughput sustained over that second. A meter with a finer time window can catch a higher instantaneous spike within a fraction of that second — both readings are correct; they’re just using a different ruler. If you need the fine-grained detail of a specific moment, the per-minute history and the series queries give you the full pattern without depending on a single instant.
What formats can I export data in?
Section titled “What formats can I export data in?”The CLI supports json, csv, and ndjson via the -o option, in addition to the default human-readable terminal output. Handy for pulling the data into a spreadsheet or another tool of your own. See the CLI guide.
What does the series command do?
Section titled “What does the series command do?”It shows how traffic evolved over a time range (say, the last hour), instead of a single snapshot of the current instant. It’s how you see trends and past spikes, drawing on the history. See the CLI guide.
Privileges
Section titled “Privileges”Do I need sudo to use it?
Section titled “Do I need sudo to use it?”Not day to day. Only installing/updating requires privileges (sudo). The daemon runs with minimal capabilities and gives you access to the socket without elevation. See Permissions.
Does it run as root?
Section titled “Does it run as root?”Not with full root. It uses CAP_BPF/CAP_PERFMON (just the capabilities needed to read eBPF) via systemd.
Your data
Section titled “Your data”Where is my data stored?
Section titled “Where is my data stored?”In local SQLite, at /var/lib/caudalghost. Nothing leaves your machine.
How do I delete the history?
Section titled “How do I delete the history?”Stop the daemon, delete the database, and restart it. See how to delete your data.
Does the app send telemetry?
Section titled “Does the app send telemetry?”No. The app has no analytics of any kind.
Editions and compatibility
Section titled “Editions and compatibility”What’s the difference between the two editions?
Section titled “What’s the difference between the two editions?”The Desktop edition bundles the daemon + CLI + GUI. The Server headless edition bundles just the daemon + CLI (no graphs), for servers. See Installation.
Does it work on my distro?
Section titled “Does it work on my distro?”On Debian/Ubuntu (amd64) 22.04+ and derivatives. Packaging for Arch/CachyOS is planned. On container-based VPS, the host may block eBPF; on bare metal it works fine.
Is it paid software?
Section titled “Is it paid software?”No. It’s free software under AGPL-3.0, free and auditable. No accounts, no freemium tier, no store. See Contributing and license.