# hengyoush/kyanos

Kyanos is a networking analysis tool using eBPF. It can visualize the time packets spend in the kernel, capture requests/responses, makes troubleshooting more efficient.

Repository: https://github.com/hengyoush/kyanos
Canonical: https://ross.abutalabs.com/products/kyanos
Homepage: https://kyanos.io
Language: C
License: Apache-2.0
License Family: permissive
Topics: command-line-tool, ebpf, network, bpf, capture, sniffer, tcp, tcpdump, tcpdump-like, command-line
Last push: 2026-08-20T15:48:31+00:00

## Health v2 (maintenance only)
Score: 87/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 98, release rhythm 87, longevity 61
- inputs: {"age_days": 855, "days_push": 13, "days_rel": 84, "gap_med": 10.0, "n_releases_24m": 15}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 5066, forks 235 (observed 2026-08-28T04:09:09.270776+00:00)

## What it is
Kyanos is an eBPF-based command-line network analysis tool that captures and visualizes L7 requests/responses (HTTP, Redis, MySQL, Kafka, MongoDB, RocketMQ, DNS) and the time packets spend in the kernel. It supports filtering by process, container, K8s pod, and protocol fields, plus aggregation analysis for fast troubleshooting.

## Use cases
- troubleshoot slow HTTP requests on a Linux server
- find which IPs are consuming my service's bandwidth
- capture Redis or MySQL traffic without tcpdump
- measure container-to-host network latency
- filter network traffic by process PID or container ID
- aggregate request latency by remote IP and protocol
- diagnose network issues inside Kubernetes pods

## When to choose
- you need L7 protocol-aware capture and latency analysis on Linux
- you want tcpdump-like capture but with aggregation and TUI output
- you troubleshoot network issues in containerized or K8s environments
- you need to see kernel-side packet latency

## When to avoid
- you need packet capture on macOS, Windows, or BSD
- you need a GUI-based packet analyzer like Wireshark
- your kernel is older than 3.10 (amd64) or 5.5 (arm64)
- you need full raw packet dumps for offline analysis

## Facets
- artifact type: cli-tool
- maturity: active
- function: monitoring, tracing, developer-tools, networking
- domain: networking, developer-tools, monitoring
- platform: cli
- tags: ebpf, packet-capture, network-troubleshooting, tcpdump-alternative, l7-protocols, tui, observability, kernel-latency-analysis, command-line, containers, linux

## Member repositories
- hengyoush/kyanos (main) score 87

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:09.270776+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:02:50.234734+00:00, confidence not recorded.
  - readme: https://github.com/hengyoush/kyanos (fetched 2026-08-28T04:09:09.270776+00:00, sha c269dfe6a646)
  - homepage: https://kyanos.io (fetched 2026-08-29T08:57:40.058121+00:00, sha 0f33bf61bfb4)
  - site_page: https://kyanos.io/quickstart.html (fetched 2026-08-29T08:57:40.060863+00:00, sha 5cb6840e9798)
- Data as of 2026-08-30T08:39:29.467469+00:00.