kubeshark

Indexes L4/L7 traffic directly from the kernel using eBPF, providing real-time and retrospective visibility without code instrumentation, as emphasized in the README for efficient data capture.

Decrypts TLS/mTLS traffic without requiring private keys or sidecar deployments, leveraging eBPF to simplify encrypted traffic analysis, a key feature highlighted in the documentation.

Exposes network data via MCP for AI-driven workflows like root cause analysis, with open-source skills for Claude and other agents, enabling natural language queries as shown in the demo.

Uses KFL to combine Kubernetes, API, and network semantics in a single query language, allowing precise traffic filtering without instrumentation, detailed in the README's query examples.

Captures and stores raw traffic in cloud storage (S3, Azure Blob, GCS) with PCAP export for tools like Wireshark, supporting long-term retention and investigation.