The trick to being an endpoint network flow monitor, is what endpoints do you support ? If you only run on Linux, you're really a Linux network flow monitor. To support the concept that all endpoints should generate network visibility and accountability data, your approach needs to run on all the endpoints you're talking about.
Porting Argus to as many platforms as possible was a big drive for the project throughout the 1990's and 2000's. We integrated Argus into network adapter cards, ethernet and ATM adapters, and we developed native argus sensors for Apple Macintosh and Windows. These were projects in venture startups, large corporations and US Government sites, so they didn't make it into the open source project. When we started working with Argus at the Naval Research Laboratory (NRL) in mid 2000's, we ported Argus to super computers (SGI, IBM, HP, Cray), to Apple Macs and Windows machines and every version of Linux, Unix, IRIX we could find.
To drive Argus's performance, we ported it to some pretty exotic hardware. Argus was ported to Tilera multi-core processors, in order to demonstrate that flow generation could scale, and to Endace Infiniband network sensors in order to measure and monitor native Infiniband network traffic at ludicrous speeds. Most of this work is reflected in the design, structure and implementation of the open source Argus.
Argus has evolved to be very efficient with limited resource demands. Its data model(s) keep the cycles per packet down, its cache management keeps memory requirements low, and the data storage demand is easily met with modern endpoints.
Today Argus runs very well on most modern computers, laptops and some tablets. We develop on Mac OS X and RedHat Linux, and there are many Linux distributions that maintain deployable Argus binaries. Still based on libpcap.1, Microsoft Windows is well supported when there is libpcap.1 style support available, such Windows Subsystem for Linux (WSL), winpcap (legacy) and npcap.