What each part of Moxon Metrics does

The window and its views 4.0

• A native window, not a browser tab, with the tabs down the left side and a tray icon showing live readings. From the tray you can pause alerts or quit.
• Basic, More and All: Basic shows the readings that matter most, More adds the detail on why things happen, All shows everything. The view only changes what is shown, never what is allowed.
• The Wireless tab appears on machines with Wi-Fi or a mobile modem.

Live

The first thing you see: the state of the machine right now and over the last few minutes.

• Tiles for processor, memory, disk activity, network, free disk space, battery, graphics, temperature, pressure and power, each with a short note on what it means.
• Processor cores: load per core and the clock speed; on Linux, throttling events; on Apple silicon, performance and efficiency clusters and thermal pressure.
• Charts for processor, memory, disk input/output, network, graphics and power, temperature and clock, and latency, over the last 5, 15, 30 or 60 minutes.
• Interfaces with live speed, Wi-Fi signal and network name, and disks with free space per drive.
• Apps right now: every app ranked by processor, memory, disk, network, graphics or energy. Search, sort, freeze the list while you read it, and click an app to see its processes.

Processes

• All processes as a list or a tree (who started what), filterable to your own, with user, processor, memory, disk, network, start time, command, threads, priority and state.
• Process details: full command line, open files, network ports and working folder for your own processes.
• Actions on your own processes: pause and resume, raise or lower priority (raising asks for your password), end, or force-end a process that hangs.
• Protection: the desktop session, system services and Moxon Metrics itself can't be ended from here.

Network

• Internet: gateway and internet latency and packet loss, public IP address (optional), and the default route.
• Wi-Fi: network name, signal and noise, band, channel and width, link rates and security.
• Interfaces: live speed of every network adapter, wired, wireless, mobile and VPN.
• Connections: every connection with its app, remote host name and state; filter to listening sockets or outgoing connections.
• Data used per month per network and interface, kept for 13 months, with optional monthly caps and alerts at 80% and 100%.

Wireless 4.0

• Wi-Fi: network, access point, band, channel and width, signal and noise, link rates and security.
• Roaming: each move between access points, when it happened, from and to which, the signal before and after, and the channel.
• Networks nearby, refreshed when you press Scan.
• Mobile: LTE and 5G modems through ModemManager, with maker and model, operator, technology, signal and whether the modem is roaming.

Topology

A map of each network the machine is on, built from what it can see and hear.

• Devices: everything nearby, from the neighbour table, the protocols heard and optional scans, identified by maker (from the hardware address), name and type, with first and last seen times. New devices can raise an alert.
• Heard on this interface (listening only, never sending): LLDP and CDP from switches and access points (system name, port, VLAN, management address), spanning tree, DHCP offers, IPv6 router adverts, mDNS (Bonjour), SSDP (UPnP) and NetBIOS.
• Routing table and policy rules, addresses, DNS and DHCP (servers, lease, expiry).
• Routing protocols on this machine: FRR, BIRD, keepalived, dnsmasq and others, with BGP and OSPF neighbour states.
• Path to the internet hop by hop, and the traffic mix (TCP, UDP, other; IPv4 versus IPv6).
• Scan network on request only: finds devices that are switched on, the common services they offer, and the names they announce. It is slow and polite (about 1,000 packets a second at most) and asks before it starts.

Capture 4.0

• Live packet capture on one interface, with an optional capture filter and a time limit of up to an hour.
• A packet list with the decoded detail and hex of each packet. Headers only by default; full packets when you ask.
• Save .pcap writes a .pcap file to Documents/moxon-metrics/captures, ready for Wireshark or any other tool.
• Each capture asks for the administrator password, and the packets go only to the app of the person who asked. Capture is available in the machine's own window only, never through sharing links or the relay.

System

• Drives: speed, busy time, response time and health per physical drive. Health comes from SMART (status, wear, spare, errors, power-on hours, temperature) and is checked hourly; warnings repeat daily until they are fixed.
• Memory: used, cached, buffers, compressed and swap, and what that means for apps.
• Pressure: how much of the time apps were stalled waiting for memory, disk or processor (Linux), or the memory pressure level (macOS).
• Sensors and fans: every temperature sensor the system exposes and fan speeds.
• Containers and virtual machines: Docker and Podman containers with processor and memory use, and QEMU, UTM and other virtual machines.
• Services (systemd on Linux, launchd on macOS): status, start, stop, restart, enable and disable, with an administrator prompt for system services. Core system services are protected.
• Startup apps: what starts when you log in, with a switch for each.
• Recent alerts and where each was sent.

History

• Every reading is kept for 30 days by default (adjustable), and per-app totals are kept in 30-minute blocks.
• Charts for the last 6 hours, 24 hours, 7 days or 30 days: processor, memory, disk, network, graphics, power, temperature, pressure, latency and battery, with markers for sleep, shutdown and restarts.
• Click any block, or pick a period, to list the apps for that half hour: processor time, memory, disk, network, graphics time and energy.
• Network by connection for the selected period, and a daily summary for the last 30 days.
• Export readings or per-app use as CSV for any range.

Terminal

• A shell on this machine, or on any of your machines through the relay, in a tab of that machine's window.
• End-to-end encrypted with keys made for each session, so neither the relay nor your other devices can read or inject anything.
• Off until switched on at the machine itself (Settings → Terminal), with a list of which of your machines may connect and "Ask me each time", which shows a prompt on the machine; no answer within a minute means no.
• Runs as the signed-in user, never as an administrator; ends after 15 minutes without typing or after 8 hours; a banner shows any open session with an End button; a log records who connected, when and for how long, never what was typed.
• Never available through local sharing links.

In Linux 3.3 and 4.0, and the macOS 3.4 preview. On a server with the headless package, switch it on with moxon terminal on.

Machines

• On this network: add another machine by pasting its sharing link. Its card shows processor, memory, fullest disk, temperature, network, pressure, uptime, battery, drive warnings and busiest apps; Open dashboard shows its full window inside yours.
• Through your relay: every machine on your relay account, online or last seen, with its dashboard and terminal one click away.

Alerts

Each alert can go to desktop notifications, ntfy (free phone push), Telegram and email, with a repeat interval so a lasting problem doesn't flood you. The indicator in the top bar or menu bar shows processor and memory at a glance.

4.0 Alerts can also go by SMS (Twilio, or any provider that takes a web request) and WhatsApp (a Meta business account or Twilio). These use your own provider account, which charges per message, so they get a one-line summary, a daily limit and quiet hours (urgent alerts still go through), and fall back to email if sending fails.

Sharing and Prometheus

• Switch on sharing to view a machine read-only from a phone or another computer on the same network, over HTTPS with an access key. A QR code opens it on a phone.
• The certificate is made on the machine and pinned by the app when you add the machine, so a changed certificate is reported, not trusted.
• "New key" stops every old link at once.
• /metrics serves the same readings in Prometheus format for Grafana and existing monitoring, protected by the same key.

Relay and phone

• Connect your machines across networks with no ports to open: each machine connects out to the relay.
• Add a machine or a phone with a one-time pairing code (or QR code) valid for 10 minutes; remove any device from any other; a recovery code gets you back in if you lose everything.
• Machines upload encrypted 5-minute summaries (kept 30 days) and hourly summaries (kept 400 days), so history stays viewable while a machine is asleep or offline.
• The phone page shows all your machines, their live summary and history charts, over Wi-Fi or mobile data.
• Everything is encrypted with a key only your devices hold. See Security and privacy.

The moxon command line 4.0

Installed with both 4.0 packages. On a server it is how you set everything up; on a desktop it is a quick way to check a machine.

What runs in the background

With the headless package, the agent runs as a system service for the user you name, so it starts at boot without anyone signing in.