Repolode
Submit
hengyoush

hengyoush/kyanos

An eBPF-based network analysis CLI that captures HTTP, Redis, MySQL, Kafka and DNS traffic and shows where latency occurs in the kernel.

Open-source alternative to:tcpdump

View on GitHubWebsite
Stars
5,080
Forks
235
Open issues
32
Last commit
12 hours ago

What is it?

Kyanos is a network issue analysis tool built on eBPF. It captures request and response traffic for protocols such as HTTP, Redis, MySQL, Kafka, MongoDB, RocketMQ and DNS, without requiring a separate packet capture and offline analysis workflow.

Beyond raw capture, it filters traffic by process, container, L7 protocol fields, byte size and latency, and can aggregate metrics such as the largest responses sent to remote IPs. For each record, it breaks down the time a packet spends between the process, the network card and the socket buffer, so you can see which stage contributes to a slow request. SSL traffic is shown in plaintext.

Kyanos ships as a single statically linked binary that prints results in the terminal. It requires root privileges and Linux kernel 3.10 (from 3.10.0-957) or 4.14 and later.

Key features

  • 01Captures HTTP, Redis, MySQL, Kafka, MongoDB, RocketMQ and DNS requests and responses.
  • 02Filters traffic by PID, container ID, protocol fields, response size and latency.
  • 03Shows per-stage latency from the network card to the socket buffer and the process.
  • 04Aggregates metrics such as the largest responses or slowest requests over a time window.
  • 05Decrypts SSL traffic and displays it in plaintext.
  • 06Ships as a single binary with results shown in the terminal.

Use cases

  • Finding the slowest requests on a host within the last few seconds.
  • Diagnosing whether latency to a Redis or other remote service is spent in the kernel, network or application.
  • Identifying which IPs or requests are responsible for a sudden spike in bandwidth on an HTTP service.
  • Troubleshooting container workloads by filtering traffic to a specific container.

Quick start

  1. 1

    Download the static binary for amd64 or arm64 from the releases page

  2. 2

    Extract the downloaded archive

    tar xvf kyanos_vx.x.x_linux_amd64.tar.gz
  3. 3

    Run kyanos with root privileges to capture all supported protocols

    sudo ./kyanos watch

Things to know

  • Linux only, since it relies on eBPF and requires kernel 3.10.0-957 or 4.14 and above.
  • Needs root privileges to run.

In collections

OpenTelemetry & observability platforms

Topics

#ebpf#network#tcp#observability#packet-capture#troubleshooting#linux#performance#bpf#capture

FAQ

What is kyanos?
An eBPF-based network analysis CLI that captures HTTP, Redis, MySQL, Kafka and DNS traffic and shows where latency occurs in the kernel. Kyanos is a network issue analysis tool built on eBPF. It captures request and response traffic for protocols such as HTTP, Redis, MySQL, Kafka, MongoDB, RocketMQ and DNS, without requiring a separate packet capture and offline analysis workflow.
Is kyanos free to use? What license does it have?
kyanos is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is kyanos still maintained?
Actively maintained. The last commit to kyanos was on Oct 24, 2026.
What can I use kyanos for?
Finding the slowest requests on a host within the last few seconds. Diagnosing whether latency to a Redis or other remote service is spent in the kernel, network or application. Identifying which IPs or requests are responsible for a sudden spike in bandwidth on an HTTP service. Troubleshooting container workloads by filtering traffic to a specific container.
How do I install kyanos?
Download the static binary for amd64 or arm64 from the releases page Extract the downloaded archive: tar xvf kyanos_vx.x.x_linux_amd64.tar.gz Run kyanos with root privileges to capture all supported protocols: sudo ./kyanos watch
Where can I get kyanos?
The source code and installation instructions are on GitHub: https://github.com/hengyoush/kyanos

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects