up9inc/mizu
Mizu
Mizu is a suite of tools for capturing, indexing, and visualizing cloud-native network traffic and decrypted payloads for cluster-wide diagnostics. It provides Kubernetes network observability by using eBPF to index and visualize layer 4 and layer 7 traffic with full cluster context, allowing for the mapping of workload dependencies and the diagnosis of network failures.
The project distinguishes itself by using kernel-level hooks to decrypt TLS traffic in plain text without requiring private keys. It further integrates a standardized context protocol to expose indexed network telemetry to AI agents, enabling natural language queries and automated root cause analysis.
The system covers comprehensive network telemetry, including protocol-aware traffic indexing, real-time semantic querying, and the generation of workload dependency maps. It also includes capabilities for recording filtered packet captures and exporting point-in-time network snapshots to cloud storage or local files.
The software supports operation in air-gapped, on-premises environments without external network dependencies.
Features
- Traffic Decryption - Intercepts and decrypts live TLS-encrypted network traffic using kernel-level hooks without requiring private keys.
- Kubernetes - Provides an integrated platform for capturing and visualizing cluster-wide network traffic and API calls using eBPF in Kubernetes.
- AI-Assisted Network Troubleshooting - Connects network observability data to AI agents via MCP to automate root cause analysis and response.
- Kubernetes Cluster Context - Correlates low-level kernel network flows with high-level Kubernetes cluster identities using the orchestrator API.
- Protocol-Aware Traffic Indexing - Parses network protocols to enable queries based on identity, API context, and network attributes without code instrumentation.
- Stream Parsing Utilities - Parses raw byte streams to index Layer 4 transport and Layer 7 application protocol metadata.
- eBPF Interceptors - Employs eBPF for kernel-level interception of network packets and system calls without application modification.
- Kernel-Level Traffic Interceptors - Intercepts network traffic at the kernel level to reveal encrypted payloads in plain text without code instrumentation.
- Network Traffic Analysis Assistants - Uses AI agents to perform automated root cause analysis and semantic filtering of network traffic.
- Network Semantic Querying - Implements a specialized query language to filter and retrieve network data using API and cluster semantics.
- Network Traffic Analyzers - Captures, filters, and indexes packet data to map workload dependencies and diagnose network failures.
- Traffic Monitoring Tools - Indexes network traffic with full Kubernetes cluster context to provide visibility into service-to-service communications.
- Communication Dependency Maps - Generates visual maps showing communication paths, traffic volume, and protocol usage between Kubernetes workloads.
- Multi-Layer Traffic Indexing - Analyzes real-time payloads and matches requests with responses across Layer 4 and Layer 7 using cluster context.
- Model Context Protocol - Implements the Model Context Protocol to expose indexed network telemetry to AI agents.
- AI Agent Context Enrichers - Provides a standardized context protocol to stream network telemetry and cluster data to AI agents for natural language queries.
- Network Traffic Snapshots - Records point-in-time network data and exports it to cloud storage or files for external analysis.
- Cloud Native Packet Captures - Records network traffic snapshots and exports raw decrypted data to cloud storage or local files.
- Traffic Inspection Tools - Inspects encrypted TLS network traffic without requiring private keys to analyze the underlying payloads.
- AI-Driven Observability Interfaces - Exposes network observability data through an AI-powered queryable interface and interactive dashboard.
- Automated Incident Response Workflows - Integrates observability data with AI assistants to automate the detection and resolution of network failures.
- Network Traffic Logs - Provides persistent storage and management of intercepted network traffic for historical analysis and retrospective investigation.
- Network Traffic Dashboards - Displays real-time network traffic matching specific queries through a semantic visual dashboard.
- Traffic Analysis - Records and filters packet captures for retrospective investigation and forensic analysis.
- Traffic Data Export - Saves raw network traffic and decrypted payloads as files or snapshots for archival and external analysis.
- Monitoring and Visualization - API traffic viewer for inspecting microservice communication.
- Kubernetes Security - API traffic viewer for Kubernetes microservices.
