Growth · alternatives · 2026
24 alternatives to Using eBPF to see through encryption without a proxy
Hi HN, I'm Tyler Flint, one of the creators of qtap. For a while now, my team and I at Qpoint.io have been grappling with the challenge of understanding what's actually happening inside the encrypted traffic leaving our production systems. Modern apps rely heavily on third-party APIs (think payment processors, data providers, etc.), but once TLS kicks in, figuring out exactly what data is being sent, identifying PII exposure, or debugging integration issues becomes incredibly difficult without resorting to complex and often brittle solutions. Traditional approaches like forward proxies…
qtap is a lightweight agent that uses eBPF technology to inspect encrypted traffic in production systems without requiring a proxy or TLS termination. It allows developers to see what data is being sent to third-party… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.
- 1
Hi HN, I'm Tyler Flint. Eight months ago we shared qtap here (https://news.ycombinator.com/item?id=43928118). Today we're releasing DevTools - a browser-based interface that gives you the Chrome Network tab experience for server-side HTTP/S traffic. The problem: You're debugging a production issue. An external dependency is returning errors. Your logs say "request failed" but not what was actually sent. Adding debug logging means redeploying and restarting services - which takes time and often changes the conditions you're trying to debug. tcpdump shows encrypted blobs.…
Jan 2026 · qpoint.io · its alternatives →
- 2FA
Introducing QuaranTab: Companion extension to quarantine tabs so you can safely use them offline with private data I find myself wanting to use online format parsers to quickly decode that production JWT or decode a base64 Authorization header but cannot trust these websites to not leak my information. I thought to myself if only I could cut-off network access to this site, use it offline, and then throw away all browsing data. So I created an extension just for that. It uses Firefox contextual identities API (Containers) to isolate browsing data and inter-tab communication. Once the site is…
2023 · its alternatives →
- 3
Context Gateway▲220We built an open-source proxy that sits between coding agents (Claude Code, OpenClaw, etc.) and the LLM, compressing tool outputs before they enter the context window. Demo: https://www.youtube.com/watch?v=-vFZ6MPrwjw#t=9s. Motivation: Agents are terrible at managing context. A single file read or grep can dump thousands of tokens into the window, most of it noise. This isn't just expensive — it actively degrades quality. Long-context benchmarks consistently show steep accuracy drops as context grows (OpenAI's GPT-5.4 eval goes from 97.2% at 32k to 36.6% at 1M…
Mar 2026 · github.com · its alternatives →
- 4
Credentials Dumper for Linux using eBPF. Contribute to citronneur/pamspy development by creating an account on GitHub.
2022 · github.com · its alternatives →
- 5
A gateway to a new, decentralized internet
2017 · blockstack.org · its alternatives →
- 6PI
2020 · pixielabs.ai · its alternatives →
- 7
Ditch Burp Suite’s bloat for zxc, a Rust-built, terminal-based proxy that uses tmux and Vim to intercept HTTP/S and WebSocket traffic. It captures requests for debugging, security testing, or tweaking—fast and lean. # Key Features - Disk Wizardry: Stashes massive datasets on disk-100k+ entries without breaking a sweat. - Addons: Boost your workflow with default support for ffuf and sqlmap, or craft your own addons for extra fun. - Buffer Tweaks: Edit variables in a popup (e.g., b:host, b:scheme) in Interceptor/Repeater to twist requests. - Config Control: TOML files for global…
2025 · github.com · its alternatives →
- 8
Write your BPF programs in Go, not C. gobee transpiles a Go subset to BPF C and generates typed cilium/ebpf bindings. - boratanrikulu/gobee
May 2026 · github.com · its alternatives →
- 9
Trayce (https://github.com/evanrolfe/trayce_gui) is an open source desktop application which monitors HTTP(S) traffic to Docker containers on your machine. It uses EBPF to achieve zero-configuration sniffing of TLS-encrypted traffic. As a backend developer I wanted something which was similar to Wireshark or the Chrome network tab, but which intercepted requests & responses to my containers for debugging in a local dev environment. Wireshark is a great tool but it seems more geared towards lower level networking tasks. When I'm developing APIs or microservices I dont care…
2024 · trayce.dev · its alternatives →
- 10
TL;DR explanation (go to https://github.com/Sakura-sx/Aroma?tab=readme-ov-file#tldr-e... if you want the formatted version) This is done by measuring the minimum TCP RTT (client.socket.tcpi_min_rtt) seen and the smoothed TCP RTT (client.socket.tcpi_rtt). I am getting this data by using Fastly Custom VCL, they get this data from the Linux kernel (struct tcp_info -> tcpi_min_rtt and tcpi_rtt). I am using Fastly for the Demo since they have PoPs all around the world and they expose TCP socket data to me. The score is calculated by doing tcpi_min_rtt/tcpi_rtt. It's…
Dec 2025 · github.com · its alternatives →
- 11
Hello Everyone, I'm excited to introduce a new open-source observability platform and would love to hear your feedback. We are aware that there are lots of open-source/commercial tools out there. However, we believe that monitoring the clusters and extracting actionable insights requires deep know-how about the tools/domain. We mainly focused on this problem. - Alaz is an eBPF agent installed on your K8s cluster as DaemonSet. Thanks to eBPF, Alaz collects traces directly from Linux kernels. This means there's no need for sidecars, instrumentations, or service restarts. - The UI not…
2023 · github.com · its alternatives →
- 12
Wiretap is a transparent, VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run. - sandialabs/wiretap
2022 · github.com · its alternatives →
- 13
Quash▲151Hey HN, I’ve been working on Quash, a mobile-first QA tool where you can write test flows in plain English and have an agent execute them on real Android devices. We’ve finally shipped a downloadable desktop app (macOS, Intel + Apple Silicon), and you can try it now. No managed “demo” environment – it runs tests against your own apps and devices. (Can connect any device locally as well)
Feb 2026 · quashbugs.com · its alternatives →
- 14
Hey HN! This is Adil, Salman and Jose and and we’re behind archgw [1]. An intelligent proxy server designed as an edge and AI gateway for agents - one that natively know how to handle prompts, not just network traffic. We’ve made several sweeping changes so sharing the project again. A bit of background on why we’ve built this project. Building AI agent demos is easy, but to create something production-ready there is a lot of repeat low-level plumbing work that everyone is doing. You’re applying guardrails to make sure unsafe or off-topic requests don’t get through. You’re clarifying vague…
2025 · github.com · its alternatives →
- 15PP
Hey HN, I've been working on an intercepting proxy for penetration testing over the last few years in my spare time. Some points of difference from the existing tools: * The UIs are built using the native platform frameworks, meaning they look and behave like other applications on the desktop. * It has a fully embedded and integrated Python scripting engine. * It’s fully native meaning it’s nicer on system resources. * It has a number of built in scripts to automate reconnaissance, content discovery, authorisation checks, etc. * The core of it is open source. I'm really keen to get any…
2023 · pakikiproxy.com · its alternatives →
- 16
Howdy folk, I've been building this project as both a side project and my job for a little while now. The rationale behind it is while wireguard is a fantastic protocol cryptographically it leaves a lot to be desired when it comes to enrollment and end user device security. Obviously instead of using an off the shelf solution like tailscale, I decided to reinvent the wheel which has honestly been quite fun with learning about eBPF, and recently clustering and HA with etcd! The most recent version (in the docker container) contains about 6 months of very new work bringing it all from sqlite3…
2024 · github.com · its alternatives →
- 17
To power the firewalling for our agents so that they couldn't contact arbitrary services, I build netfence. It's like Envoy but for eBPF filters. It allows you to define different DNS-based rules that are resolved in a local daemon to IPs, then pushed to the eBPF filter to allow traffic. By doing it this way, we can still allow DNS-defined rules, but prevent contacting random IPs. There's also no network performance penalty, since it's just DNS lookups and eBPF filters referencing memory. It also means you don't have to tamper with the base image, which the agent could potentially manipulate…
Jan 2026 · github.com · its alternatives →
- 18
Heron ▲105Wireshark for AI Agents: passive eBPF observability
Jun 2026 · github.com · its alternatives →
- 19
eBPF is an amazing technology that allows safely running user-supplied functions at pretty much arbitrary probe points in a kernel/user space context. Much has been written about how amazing this feature is for kernel observability. But as someone who writes user space code, what I find even more amazing is the support for tracing arbitrary user space programs, with no code changes and low overhead. However, doing in-depth analysis can get complicated and time-consuming. My goal with wachy was to make this debugging significantly easier/faster to use, by displaying traces in a TUI…
2022 · rubrikinc.github.io · its alternatives →
- 20
Facebook's Katran looked too scary (and I don't do C++), so I thought I would investigate using XDP/eBPF to redirect packets at high speed and Go to do the control plane work of health-checking backed servers and managing configuration. With luck the resulting binary should be easy to deploy by non-developers. It's still not mature, but seems to work. Code was written in a very exploratory manner, and I'm not a developer so it is quite shocking at the moment, but I aim to improve it. It is intended to be horizontally scalable with ECMP and has been tested on service providing…
2022 · github.com · its alternatives →
- 21
The only way to go fast is full YOLO mode in your coding agent. I've got the local sandbox figured out (pro tip: Incus VMs work great) but I wanted to keep my agents from doing things like inadvertently blowing up my cloud services or chasing a prompt to POST to some random website. I struggle most with this on my side projects where my permission model isn't quite as robust as it is at the office. I started with a firewall on the Incus container but every time the agent needed access to something new, I was poking more holes in it - and it didn't differentiate between HTTP verbs. I've been…
Jul 2026 · trollbridge.dev · its alternatives →
- 22
I started using Claude Code (claude --dangerously-skip-permissions) and Codex (codex --yolo) and realized I had no reliable way to know what they actually did. The agent's own output tells you a story, but it's the agent's story. logira records exec, file, and network events at the OS level via eBPF, scoped per run. Events are saved locally in JSONL and SQLite. It ships with default detection rules for credential access, persistence changes, suspicious exec patterns, and more. Observe-only – it never blocks. https://github.com/melonattacker/logira
Mar 2026 · github.com · its alternatives →
- 23
eBPF/XDP packet filtering for Linux. Contribute to boratanrikulu/durdur development by creating an account on GitHub.
2022 · github.com · its alternatives →
- 24
Hi HN! I'm Mo, a platform engineer at Deltaflare working on critical infrastructure protection. I built Cerberus because traditional packet capture tools (tcpdump, Wireshark) have too much overhead for production CNI environments. eBPF lets us filter and classify packets at the kernel level with near-zero performance impact. Some interesting challenges: - eBPF verifier is strict - every memory access needs bounds checking - Limited to 32 bytes of L7 payload (tradeoff between inspection depth and overhead) - TC vs XDP decision (chose TC for compatibility) Looking for contributors, especially…
Dec 2025 · github.com · its alternatives →
Also compare
- QTap DevTools – Chrome-style encrypted traffic inspector for Linux alternatives
- Firefox addon to quarantine a tab to use offline with private data alternatives
- Context Gateway alternatives
- Credentials dumper for Linux using eBPF alternatives
- Blockstack Browser alternatives
- Pixie, Instant Kubernetes-Native Application Observability Using EBPF alternatives
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →