Life & fun · alternatives · 2026
24 alternatives to Cerberus – Real-time network monitor with eBPF
Hi HN! I'm Mo, a platform engineer at Deltaflare working on critical infrastructure protection. I built Cerberus because traditional packet capture tools (tcpdump, Wireshark) have too much overhead for production CNI environments. eBPF lets us filter and classify packets at the kernel level with near-zero performance impact. Some interesting challenges: - eBPF verifier is strict - every memory access needs bounds checking - Limited to 32 bytes of L7 payload (tradeoff between inspection depth and overhead) - TC vs XDP decision (chose TC for compatibility) Looking for contributors, especially…
Cerberus is a real-time network monitoring tool that uses eBPF to capture and classify network packets at the kernel level. Built for production container networking environments, it offers significantly lower… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.
- 1
Credentials Dumper for Linux using eBPF. Contribute to citronneur/pamspy development by creating an account on GitHub.
2022 · github.com · its alternatives →
- 2
Always on Profiling for Production Systems
2024 · 0x.tools · its alternatives →
- 3
An eBPF tool monitoring a goroutine. Contribute to keisku/gmon development by creating an account on GitHub.
2024 · github.com · its alternatives →
- 4
Write your BPF programs in Go, not C. gobee transpiles a Go subset to BPF C and generates typed cilium/ebpf bindings. - boratanrikulu/gobee
May 2026 · github.com · its alternatives →
- 5
Hi HN, I'm Tyler Flint, one of the creators of qtap. For a while now, my team and I at Qpoint.io have been grappling with the challenge of understanding what's actually happening inside the encrypted traffic leaving our production systems. Modern apps rely heavily on third-party APIs (think payment processors, data providers, etc.), but once TLS kicks in, figuring out exactly what data is being sent, identifying PII exposure, or debugging integration issues becomes incredibly difficult without resorting to complex and often brittle solutions. Traditional approaches like forward proxies…
2025 · github.com · its alternatives →
- 6
Hello Everyone, I'm excited to introduce a new open-source observability platform and would love to hear your feedback. We are aware that there are lots of open-source/commercial tools out there. However, we believe that monitoring the clusters and extracting actionable insights requires deep know-how about the tools/domain. We mainly focused on this problem. - Alaz is an eBPF agent installed on your K8s cluster as DaemonSet. Thanks to eBPF, Alaz collects traces directly from Linux kernels. This means there's no need for sidecars, instrumentations, or service restarts. - The UI not…
2023 · github.com · its alternatives →
- 7
Trayce (https://github.com/evanrolfe/trayce_gui) is an open source desktop application which monitors HTTP(S) traffic to Docker containers on your machine. It uses EBPF to achieve zero-configuration sniffing of TLS-encrypted traffic. As a backend developer I wanted something which was similar to Wireshark or the Chrome network tab, but which intercepted requests & responses to my containers for debugging in a local dev environment. Wireshark is a great tool but it seems more geared towards lower level networking tasks. When I'm developing APIs or microservices I dont care…
2024 · trayce.dev · its alternatives →
- 8
eBPF is an amazing technology that allows safely running user-supplied functions at pretty much arbitrary probe points in a kernel/user space context. Much has been written about how amazing this feature is for kernel observability. But as someone who writes user space code, what I find even more amazing is the support for tracing arbitrary user space programs, with no code changes and low overhead. However, doing in-depth analysis can get complicated and time-consuming. My goal with wachy was to make this debugging significantly easier/faster to use, by displaying traces in a TUI…
2022 · rubrikinc.github.io · its alternatives →
- 9
I kept missing incidents until it was too late. By the time my monitoring alerted me, servers/nodes were already unrecoverable. So I built Linnix. It watches your Linux systems at the kernel level using eBPF and tries to catch problems before they cascade into outages. The idea is simple: instead of alerting you after your server runs out of memory, it notices when memory allocation patterns look weird and tells you "hey, this looks bad." It uses a local LLM to spot patterns. Not trying to build AGI here - just pattern matching on process behavior. Turns out LLMs are actually pretty…
Nov 2025 · github.com · its alternatives →
- 10
eBPF/XDP packet filtering for Linux. Contribute to boratanrikulu/durdur development by creating an account on GitHub.
2022 · github.com · its alternatives →
- 11NM
A real-time network connection monitoring tool built with Rust and GTK4, displaying active connections with live I/O statistics in a modern graphical interface. https://github.com/grigio/network-monitor
Nov 2025 · its alternatives →
- 12
Hi all, I'm excited to announce Stratoshark, a sibling application to Wireshark that lets you capture and analyze process activity (system calls) and log messages in the same way that Wireshark lets you capture and analyze network packets. If you would like to try it out you can download installers for Windows and macOS and source code for all platforms at https://stratoshark.org. AMA: I'm the goofball whose name is at the top of the "About" box in both applications, and I'll be happy to answer any questions you might have.
2025 · stratoshark.org · its alternatives →
- 13
groundcover▲225Monitor K8s applications effortlessly, at scale
2022 · groundcover.com · its alternatives →
- 14
eBPF based tool to monitor disk usage, perform actions when threshold breached. - Lakshmipathi/ebpf-diskalert
2023 · github.com · its alternatives →
- 15
To power the firewalling for our agents so that they couldn't contact arbitrary services, I build netfence. It's like Envoy but for eBPF filters. It allows you to define different DNS-based rules that are resolved in a local daemon to IPs, then pushed to the eBPF filter to allow traffic. By doing it this way, we can still allow DNS-defined rules, but prevent contacting random IPs. There's also no network performance penalty, since it's just DNS lookups and eBPF filters referencing memory. It also means you don't have to tamper with the base image, which the agent could potentially manipulate…
Jan 2026 · github.com · its alternatives →
- 16PI
2020 · pixielabs.ai · its alternatives →
- 17
Heron ▲105Wireshark for AI Agents: passive eBPF observability
Jun 2026 · github.com · its alternatives →
- 18
Hi everyone, I recently published a small open-source project. It’s a minimal network packet analyzer written in Go — designed more like a learning toy than a replacement for Wireshark. It currently supports parsing basic protocols like TLS, DNS, and HTTP, and includes a tiny fuzzing engine to test payload responses. You can inspect raw packet content directly from the terminal. The output is colored for readability, and the code structure is kept simple and clear. The entire program is very small — just about 400 lines of Go code. I know it’s not anywhere near Wireshark’s level, and I still…
2025 · github.com · its alternatives →
- 19SA
I've frequently found myself using [nvitop](https://github.com/XuehaiPan/nvitop) to diagnose GPU/CPU contention issues. The two best things about it are: - It's easy to install if I can access pip in the container - It makes a compelling screenshot (which helps me communicate with coworkers.) With those two lessons in mind: Here is Sping! Purpose: Help observe and diagnose latency issues at layer 4+ (TCP/HTTP/HTTPS) Two good things about it: - It's easy to install if you have pip. (Available at…
2025 · dseltzer.gitlab.io · its alternatives →
- 20
A common open source approach to observability will begin with databases and visualizations for telemetry - Grafana, Prometheus, Jaeger. But observability doesn’t begin and end here: these tools require configuration, dashboard customization, and may not actually pinpoint the data you need to mitigate system risks. Coroot was designed to solve the problem of manual, time-consuming observability analysis: it handles the full observability journey — from collecting telemetry to turning it into actionable insights. We also strongly believe that simple observability should be an innovation…
2025 · github.com · its alternatives →
- 21JR
Jibril is a runtime security monitoring and enforcement tool. It introduces a new architecture designed to overcome limitations of previous-generation runtime security tooling and EDRs, which were primarily built for traditional endpoints and long-running containerized workloads. Jibril introduces an event-less architecture leveraging eBPF to maintain lightweight state maps directly within the kernel. Instead of buffering events, it queries kernel state directly, enabling real-time detection and enforcement with minimal overhead. This approach is especially effective for protecting ephemeral…
2025 · garnet.ai · its alternatives →
- 22
- 23
Per-executable network bandwidth monitoring for Linux
2022 · elesiuta.github.io · its alternatives →
- 24
Hello, I just released the (eventually) final version of my xcapture eBPF performance tool that now uses modern eBPF (libbpf, BTF, CO-RE, passive sampling using task iterators, task-local storage, etc). The previous BCC-based v2 version got a good discussion here last year [1], but due to BCC being less flexible and now deprecated, I decided to pull the plug and start from scratch with the latest eBPF features available. I'm targeting Linux kernels 5.14 and up. So Ubuntu 20 with HWE kernel (5.15) already works, RHEL9 works, Oracle's RHEL8 clone OEL8 with Oracle's UEK7 kernel (5.15) also…
2025 · tanelpoder.com · its alternatives →
Also compare
- Credentials dumper for Linux using eBPF alternatives
- Xcapture-BPF – like Linux top, but with Xray vision alternatives
- Goroutine Monitor Powered by eBPF alternatives
- Write your BPF programs in Go, not C alternatives
- Using eBPF to see through encryption without a proxy alternatives
- Alaz: Open-Source, Self-Hosted, eBPF-Based K8s Monitoring alternatives
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →