Qtap

lastmod 2025-05-18created 2025-05-181 edits

An eBPF agent that captures encrypted network traffic

Features

• A tool that uses eBPF to capture traffic passing through the Linux kernel before/after encryption
• Hooks into TLS/SSL functions to collect richer traffic context (process, container, host, user, protocol, etc.) than traditional packet capture methods
• Gives insight into the original network data and process information without modifying applications, setting up a proxy, or managing certificates
  • Many uses, including security auditing, network debugging, API development, troubleshooting third-party integrations, learning and analyzing protocols, and analyzing legacy systems
• Lets you view real traffic in the terminal in real time with low overhead
• Custom plugins are easy to develop/integrate, so it integrates easily with existing observability systems or serves as the foundation for new solutions
• Currently in early development; offered under both the AGPLv3 open-source license and a commercial license

See also

• eBPF

Favorite site

• Github - qpoint-io/qtap