Kyanos is an eBPF-based network analysis tool that captures and visualizes network traffic with kernel-level latency insights.
The tool addresses the challenge of diagnosing network performance issues without the overhead of traditional packet capture and analysis workflows. It uses eBPF to intercept network requests at the kernel level, capturing application-layer protocols including HTTP, Redis, MySQL, Kafka, MongoDB, RocketMQ, and DNS. Beyond simple packet capture, Kyanos aggregates metrics across multiple dimensions—such as process, container, protocol details, payload size, and latency—to surface the most relevant troubleshooting data in a single command. It also provides detailed kernel-level timing information showing exactly where delays occur as packets move through network stack stages, and automatically decrypts SSL traffic for inspection.
Kyanos suits teams debugging production network performance issues who need rapid diagnosis without deploying complex monitoring infrastructure. It works well for identifying which remote IPs or specific requests are consuming bandwidth, analyzing slow queries to backend services, and pinpointing whether latency originates in the application, kernel, or network. The tool distinguishes itself from tcpdump by offering aggregated analysis and L7 protocol awareness rather than raw packet dumps, and by providing kernel-level latency breakdowns that reveal exactly which stage of packet processing causes delays. It requires only a single binary with minimal dependencies and runs entirely from the command line.
The project shows consistent development activity with regular commits addressing bug fixes and feature additions. The maintainers actively respond to issues and pull requests, indicating ongoing engagement with users. Documentation is maintained across multiple languages, reflecting attention to accessibility for a broader audience. The tool has received recognition through community features and trending indicators, suggesting sustained interest and adoption.
