kubeshark/kubeshark

Features

• Network Traffic Analyzers - Captures and analyzes cluster-wide network traffic to visualize service dependencies and communication patterns.
• eBPF Interceptors - Uses kernel-level probes to capture network packets and system events directly from the operating system without requiring sidecar proxies.
• Kubernetes - Captures, indexes, and visualizes cluster-wide network traffic and API calls using eBPF for deep service-level insights.
• Debugging and Inspection Tools - Dissects and inspects HTTP, gRPC, and Kafka request payloads in real-time to troubleshoot service interactions and identify API-level errors.
• Kubernetes API Inspectors - Provides a dashboard for real-time analysis of request and response payloads across services without code instrumentation.
• Service Mesh Alternatives - Monitors and decrypts internal service communication without requiring manual certificate management or sidecar proxies.
• Hooking Utilities - Intercepts encrypted traffic by dynamically hooking into process-level memory to access plaintext data before it is sent over the network.
• Traffic Inspection Tools - Intercepts and decrypts encrypted network traffic to provide real-time visibility into application-layer protocols.
• Automated Root Cause Analysis - Integrates network telemetry with AI assistants to perform automated root cause analysis and query traffic patterns using natural language.
• Application Layer Protocol Dissectors - Reconstructs and decodes protocols like HTTP, gRPC, and Kafka to display full request and response payloads.
• Distributed Observability Platforms - Deploys lightweight monitoring components across cluster nodes to collect and process network telemetry in parallel for high-performance observability.
• Air-Gapped Deployments - Operates within isolated networks by disabling external dependencies and utilizing local container image registries for all required components.
• Resource Controllers - Leverages standard cluster APIs and custom resource definitions to manage monitoring deployments, access controls, and network traffic scoping.
• API Payload Inspectors - Dissects captured traffic to reveal chronological sequences of API calls and full request/response payloads.
• Role-Based Access Control - Manages granular user permissions for accessing live traffic streams, snapshots, and configuration settings.
• Cloud-Native - Provides tools for capturing and querying network snapshots to perform security audits in containerized environments.
• Kubernetes Monitors - Correlates network traffic with cluster metadata to identify communication paths between pods, services, and nodes.
• Cloud Storage Integrations - Uploads and retrieves captured network traffic data to cloud object storage providers for long-term retention, backup, and cross-cluster sharing.
• Search and Indexing - Parses and indexes raw network packets into structured protocol data to enable fast, cluster-wide searching.
• Snapshot Buffers - Buffers captured network data in local memory or temporary disk volumes with automated lifecycle management to minimize long-term resource footprint.
• Infrastructure Event Correlation Tools - Links network traffic data with infrastructure API server events and operating system activity for a unified view.
• Ingress Controllers - Configures stable and secure network routes to the observability dashboard using standard cluster ingress resources for persistent access.
• Network Flow Analyzers - Captures connection data to monitor handshake latency, throughput, and connection lifecycle events across the cluster.
• Automatic Redaction - Automatically detects and removes sensitive information from traffic data at the source.
• Namespace Access Controls - Filters traffic visibility at the server level based on assigned Kubernetes namespaces.
• Network Traffic Analysis Assistants - Integrates network data into AI assistants to perform automated root cause analysis and debug connectivity issues.
• Root Cause Analysis - Provides deep packet inspection and forensic data to accelerate root cause analysis during service anomalies.
• Search Indexing - Processes captured traffic snapshots into searchable databases for efficient historical network activity retrieval.
• Search and Indexing - Decouples raw packet capture from data processing to enable intensive protocol analysis and search indexing on non-production compute resources.
• Deployment Management - Installs network observability tools within dedicated namespaces on managed container platforms to ensure isolated and secure traffic monitoring.
• Storage Management - Stores captured traffic in-memory or on local disk with configurable time-to-live settings to ensure data remains within the cluster environment.
• TLS Fingerprinting - Computes JA3 and JA3S hashes to identify applications and detect anomalous traffic patterns.
• SSL/TLS Analyzers - Analyzes handshake negotiation data to identify insecure TLS versions and weak cipher suites.
• Identity Provider Integrations - Validates user identities against corporate OIDC and SAML providers for secure dashboard access.
• Forensic Tools - Provides forensic investigation capabilities for network traffic snapshots in containerized environments.
• Automated Incident Response Workflows - Executes reusable instruction sets that guide AI agents through standardized diagnostic procedures for incident response.
• Monitoring and Observability - Provides deep visibility into process behavior and system calls using eBPF-powered kernel-level tracing.
• Observability Tools - Enables starting or stopping network monitoring deployments within a cluster through proxy connections to control data collection and resource usage.
• Resource Optimization - Toggles traffic capture and scopes monitoring to specific workloads to minimize resource usage.
• Code-Telemetry Correlation Tools - Integrates network observability data with local source code to identify configuration errors or logic flaws.
• Traffic Filtering - Queries indexed network traffic using expression-based syntax to isolate specific requests and responses for analysis.

Star history