ayaFlow is a high-performance network traffic analyzer built with eBPF and Rust, designed to offer kernel-native visibility into network traffic on Kubernetes. It eliminates the need for a sidecar by using a per-node DaemonSet configuration, ensuring real-time monitoring and deep packet inspection while maintaining minimal performance overhead.
ayaFlow is a powerful, eBPF-based network traffic analyzer meticulously engineered in Rust. Optimized for Kubernetes, it functions as a sidecarless DaemonSet, providing exceptional kernel-native visibility into node-wide network traffic while maintaining minimal overhead.
Kernel: NIC --> TC Hook (eBPF, ingress + egress) --> RingBuf
|
Userspace: Tokio Event Loop
/ | \
DashMap SQLite Axum HTTP
(live stats) (history) (API + /metrics)
The architecture consists of a kernel-side Traffic Control (TC) classifier that processes Ethernet, IPv4, TCP, and UDP headers, directing lightweight PacketEvent structs (tagged with direction) into a shared ring buffer. A user-space async Tokio agent polls this buffer, managing live connection states in a DashMap, persisting events to SQLite, and providing a REST API coupled with Prometheus metrics.
ayaflow_packets_total and ayaflow_active_connections.In performance tests on a minimal VM (Ubuntu 24.04, 2 vCPU, 2 GB RAM), ayaFlow showcases impressive efficiency:
| Metric | Value |
|---|---|
| Userspace RSS (steady-state) | ~33 MB |
| eBPF program (xlated) | 784 B |
| eBPF program (JIT-compiled) | 576 B |
| eBPF program memlock | 4 KB |
| EVENTS ring buffer | 256 KB |
| PAYLOAD_EVENTS ring buffer | 256 KB |
| Memory growth over time | None observed |
The eBPF classifier's successful loading can be verified using bpftool, ensuring optimal integration with the Linux kernel.
bpf-linkerExplore ayaFlow for efficient, real-time network traffic analysis that enhances visibility and control over your Kubernetes environment.
No comments yet.
Sign in to be the first to comment.