Visualizing your Tailscale network traffic with TSFlow

Ever stared at network logs at 2 AM, trying to figure out why your API suddenly got slow? You're not alone. While Tailscale makes secure networking beautifully simple, understanding what's actually happening across your tailnet as it grows can feel like reading tea leaves.

That's exactly the problem I faced as a Customer Success Engineer at Tailscale. I kept hearing from customers who loved how easy Tailscale made networking but struggled to visualize their traffic patterns. So I built TSFlow: a real-time network visualizer that transforms your Tailscale logs into the kind of interactive insights you actually want to look at.

The problem: Network logs aren't exactly... visual

Tailscale's identity-based networking is incredibly powerful, but as your tailnet grows, the question "what's actually happening on my network?" becomes harder to answer. Push a new ACL configuration to 200 devices, and good luck figuring out if it's working as intended by staring at raw logs.

Here's what I kept hearing from customers:

“I deployed new access controls last week, but I have no idea if they're actually blocking the traffic I intended.”
“Our API response times are terrible, but I can't tell which devices are hammering our database servers.”
“My security team wants to see network segmentation for our compliance audit, but all I have are text logs.”

Sound familiar? TSFlow solves exactly these problems by turning your Tailscale network flow logs into something beautiful and actionable.

Why existing tools fall short

Traditional network monitoring tools were built for a different era—when networks had clear perimeters and fixed IP addresses. They're not designed for the dynamic, identity-based networks that Tailscale enables.

You've probably tried using them and hit these frustrations:

• Complex setup: Requires dedicated infrastructure and specialized knowledge
• Poor integration: Doesn't understand Tailscale's device identity model
• Overwhelming data: Shows everything but highlights nothing important
• No real-time insight: Historical dashboards don't help during active incidents

We needed something purpose-built for the Tailscale ecosystem—something that understands your devices, respects your ACLs, and shows you exactly what you need to know, when you need to know it.

Meet TSFlow: Network visualization that actually makes sense

TSFlow transforms your Tailscale network flow logs into visualizations that make you say, "Oh, that's what's happening on my network." Built with a clean Go backend and modern React frontend, it's designed to feel familiar to anyone who's used modern web applications.

Your network topology, alive and interactive

Remember those network diagrams you drew on whiteboards? TSFlow makes them real and interactive:

• Force-directed graphs that show how your devices actually relate to each other
• Real-time traffic animations so you can watch data flow as it happens
• Multiple layout options (force-directed, circular, grid, hierarchical) because everyone thinks about networks differently
• Zoom and pan controls for when you need to dive deep into complex topologies

Analytics that answer your actual questions

No more squinting at log files. TSFlow's analytics dashboard shows:

• Live traffic metrics and bandwidth utilization across your tailnet
• Protocol breakdown (TCP, UDP, ICMP) with statistics that actually matter
• Device activity monitoring so you know what's online, offline, and in between
• Historical trends with customizable time ranges

Filtering that finds the needle in the haystack

Whether you're hunting down a performance issue or investigating unusual traffic:

• Flexible time ranges from "show me the last 5 minutes" to custom date ranges
• Protocol filtering to focus on exactly the traffic type you care about
• Traffic categorization (virtual, subnet, physical) matching your network structure
• Device and tag-based filtering that aligns with your existing Tailscale organization

Real stories from real networks

“Finally, ACL verification that actually works”
Sarah, a DevOps engineer at a fast-growing startup, was tired of deploying ACL changes and crossing her fingers. With TSFlow, she can immediately see if her new policies are working correctly—the network topology view clearly shows allowed and blocked connections.

“Found our performance bottleneck in 30 seconds”
When Marcus's team reported slow API responses, TSFlow's bandwidth visualization immediately highlighted that their CI/CD pipeline was routing all traffic through their most expensive cloud region. What used to take hours now takes less than a minute.

“Security monitoring that doesn't require a PhD”
TSFlow's real-time visualizations make unusual traffic patterns immediately obvious. Whether it's unexpected device-to-device communication or suspicious traffic spikes, security teams can spot and investigate issues quickly.

“Onboarding new team members just got easier”
Instead of trying to explain network topology with static diagrams, teams are using TSFlow as living documentation. New engineers can clearly see how the network is structured and how their services fit in.

Get started

TSFlow works seamlessly with your existing Tailscale setup—no additional infrastructure, complex configuration, or advanced networking experience required.

What you'll need

• A Tailscale API key with devices:read and logs:read permissions (get one here)
• Tailscale network logs enabled
• Docker installed

The fastest way to see your network

Note:
While TSFlow was created by a Tailscale employee, it has been open-sourced in the spirit of community collaboration, similar to other Tailscale community projects. We're sharing it to be helpful, but please note that it's a community-maintained project and not officially supported by Tailscale.