🔍 InfraLens

See every connection in your infrastructure — without touching a single line of code.

InfraLens uses eBPF to discover and visualize service-to-service communication in real time, on Kubernetes clusters and plain Linux servers. No sidecars. No SDKs. No instrumentation.

Try the demo · Install · How it works · Features · Contributing

⚡ Try It in 30 Seconds

No Linux, no eBPF, no agents — demo mode simulates a realistic multi-node topology with live traffic. Works on macOS, Windows, and Linux:

git clone https://github.com/Herenn/Infralens.git
cd Infralens/deploy/docker-compose
docker compose -f demo.yml up -d

Open http://localhost:3000 — you'll see servers, services, live throughput, and UDP flows. Click any node to inspect it, press / to search.

🤔 Why InfraLens?

You inherit a cluster, or your architecture diagram is six months stale, and the question is always the same: what actually talks to what? Traditional APM answers it by making you instrument every service. Service-mesh tools answer it if you're willing to run a mesh.

InfraLens answers it from the kernel — deploy the agent, and every TCP connection and UDP flow on the box appears on a live map within seconds.

	InfraLens	Traditional APM	Service Mesh Observability
Code changes required	None	SDK in every service	None
Infrastructure required	One agent per node	Agents + config per app	Full mesh (sidecars/CNI)
Works outside Kubernetes	Yes — any Linux server	Varies	No
Sees non-HTTP traffic (DBs, queues, DNS)	Yes — TCP + UDP at kernel level	Only instrumented calls	Mostly yes
Explains unknown services	Yes — fingerprinting + AI docs	No	No
Time to first insight	Seconds	Days–weeks	Days

🎯 Features

See everything

🕸️ Live topology map — services grouped by server, edges showing real-time throughput, rendered with React Flow
🌐 TCP + UDP, IPv4 + IPv6 — outbound, inbound, and UDP flows (DNS, StatsD, syslog) traced at the kernel with <1% CPU overhead
📊 Host metrics — per-server CPU/RAM bars, bytes/packets per connection with live rates

Understand it

🔎 Service fingerprinting — PostgreSQL, Redis, Nginx, Kafka, and dozens more identified from ports and process names
🧠 AI-generated docs — click any service and get architecture, security, and performance analysis (OpenAI, Anthropic, Gemini, or fully local via Ollama/LM Studio)
🔬 Deep inspection — protocol probing (HTTP headers, DB handshakes), dependency discovery from package.json/go.mod/requirements.txt
⌨️ Search & export — find any node instantly (/), export the graph as PNG, JSON, Mermaid, or Graphviz DOT

Run it anywhere

☸️ Kubernetes native — DaemonSet + RBAC, automatic IP → Pod/Service name resolution via client-go informers
🖥️ Plain Linux servers — one-line installer, systemd service, multi-node agents reporting to one backend
🔒 Production ready — API-key agent auth, HTTPS support, SQLite/PostgreSQL persistence, Prometheus /metrics, CO-RE portability across kernels 5.8+

What's new in v2.0.0

Demo mode — try InfraLens without Linux/eBPF/agents (DEMO_MODE=true)
UDP tracing — DNS, StatsD, and other UDP flows with dashed edges and protocol badges
Topology search — by name, IP, technology, or node
Delta WebSocket updates — incremental updates instead of full snapshots every 2s
Graph export — Mermaid and Graphviz DOT
Working agent auth — --api-key / INFRALENS_API_KEY + HTTPS backend URLs
Proxy-friendly frontend — same-origin URLs work behind any ingress/TLS

See CHANGELOG.md for the full history.

🏗️ How It Works

flowchart TB
    subgraph infra["Your Infrastructure"]
        A[Service A] --> B[Service B]
        B --> C[Service C]
        A --> C
    end

    subgraph ebpf["Kernel Space"]
        trace[eBPF Probes<br/>tcp_connect / accept / send / recv / udp_sendmsg]
    end

    subgraph agent["InfraLens Agent"]
        collector[Collector<br/>Event Parsing]
        inspector[Deep Inspector]
        metrics[Host Metrics]
    end

    subgraph backend["InfraLens Backend"]
        api[REST API]
        ws[WebSocket<br/>delta updates]
        db[(SQLite/Postgres)]
        ai[AI Providers]
    end

    subgraph frontend["InfraLens Frontend"]
        react[React Flow<br/>Topology View]
    end

    infra -.->|kernel tracing| ebpf
    ebpf --> agent
    agent -->|HTTP POST| backend
    backend <-->|real-time| frontend

Agent (one per node) attaches eBPF probes to kernel functions like tcp_v4_connect and udp_sendmsg, capturing every connection with process context — no packet capture, no proxies.
Backend aggregates events from all agents, resolves Kubernetes IPs to Pod/Service names, fingerprints services, and persists to SQLite or PostgreSQL.
Frontend renders the live topology over a delta-based WebSocket, with search, filters, drill-down drawers, and AI documentation.

🚀 Installation

Kubernetes (Helm)

helm install infralens ./deploy/helm/infralens -n infralens --create-namespace \
  --set ingress.enabled=true \
  --set backend.auth.apiKey="$(openssl rand -hex 32)"

Linux Servers (one-liner)

# Full stack (main server)
curl -sSL https://raw.githubusercontent.com/Herenn/Infralens/main/scripts/install-full.sh | sudo bash

# Agent only (each additional server)
curl -sSL https://raw.githubusercontent.com/Herenn/Infralens/main/scripts/install-agent.sh | sudo bash -s -- --backend=YOUR_BACKEND_IP:8080

Docker Compose

cd deploy/docker-compose
cp env.example .env   # optional: API keys, auth
docker compose up -d

Dashboard: http://localhost:3000

Requirements for real tracing: Linux kernel 5.8+ with BTF (ls /sys/kernel/btf/vmlinux must exist — default on Ubuntu 20.04+, Debian 11+, Fedora 31+). The agent is CO-RE: compile once, run on any supported kernel. No kernel requirements for demo mode.

🤖 AI-Powered Documentation

Click any service → AI Docs → get a generated explanation of what the service does, its tech stack, network behavior, security considerations, and recommendations — built from its network topology, protocol probes, runtime metrics, and (optionally) project files like README and Dockerfile.

Provider	Type	Default Model
OpenAI	Cloud	GPT-3.5-turbo
Anthropic	Cloud	Claude 3 Haiku
Google Gemini	Cloud	Gemini Pro
Ollama	Local	Llama2
LM Studio	Local	Any compatible

🔒 Privacy first: only non-sensitive files (README, Dockerfile, package manifests) are used for context, on-demand, never stored. .env files and secrets are always excluded. Use Ollama/LM Studio to keep everything on your own hardware.

⚙️ Configuration

Common settings (see the full reference below):

DEMO_MODE=true                  # Simulated topology, no agents needed
DB_DRIVER=postgres              # sqlite (default) or postgres
API_KEY=$(openssl rand -hex 32) # Require agent authentication
CORS_ORIGINS=https://infralens.example.com

Agents authenticate with --api-key (or INFRALENS_API_KEY) and support HTTPS backends:

sudo ./infralens-agent --backend=https://infralens.example.com --api-key="your-secret-key"

All environment variables

# ── Server ──────────────────────────────────────────────
LISTEN_ADDR=:8080              # HTTP listen address
DEBUG=false                    # Enable debug logging
DEMO_MODE=false                # Simulate a live topology (no agents needed)
READ_TIMEOUT=15s               # HTTP read timeout
WRITE_TIMEOUT=15s              # HTTP write timeout

# ── Database ────────────────────────────────────────────
DB_DRIVER=sqlite               # Database driver: sqlite or postgres
DB_DSN=infralens.db            # SQLite: file path, Postgres: connection string
DB_AUTO_MIGRATE=true           # Run migrations on startup
DB_MAX_OPEN_CONNS=25           # Max open connections (default: 1 for SQLite, 25 for Postgres)
DB_MAX_IDLE_CONNS=5            # Max idle connections
DB_CONN_MAX_LIFETIME=5m        # Connection max lifetime

# ── Data pruning ────────────────────────────────────────
PRUNE_INTERVAL=5m              # How often to prune stale data (0 to disable)
PRUNE_MAX_AGE=30m              # Delete data older than this

# ── Security ────────────────────────────────────────────
API_KEY=                       # API key for agent auth (empty = disabled)
API_KEY_HEADER=X-API-Key       # Header name for API key
CORS_ORIGINS=*                 # Comma-separated allowed origins
CORS_CREDENTIALS=true          # Allow credentials in CORS

# ── AI providers ────────────────────────────────────────
OPENAI_API_KEY=sk-...          # OpenAI API key
OPENAI_MODEL=gpt-3.5-turbo
ANTHROPIC_API_KEY=sk-ant-...   # Anthropic API key
ANTHROPIC_MODEL=claude-3-haiku-20240307
GEMINI_API_KEY=AIza...         # Google Gemini API key
GEMINI_MODEL=gemini-pro
OLLAMA_URL=http://localhost:11434
OLLAMA_MODEL=llama2
LMSTUDIO_URL=http://localhost:1234
LMSTUDIO_MODEL=
DEFAULT_LLM_PROVIDER=openai

Security details: protected endpoints, CORS, databases

Protected endpoints (when API_KEY is set): POST /api/v1/events, /api/v1/stats, /api/v1/metrics, /api/v1/inspection

Public endpoints (always accessible): GET /api/v1/topology, /api/v1/services, /api/v1/ws (WebSocket), /health, /ready

CORS:

export CORS_ORIGINS="*"                                    # development
export CORS_ORIGINS="https://infralens.example.com"        # production

Databases:

# SQLite (default - development/single node)
export DB_DRIVER=sqlite
export DB_DSN=infralens.db

# PostgreSQL (production/high volume)
export DB_DRIVER=postgres
export DB_DSN="postgres://user:password@localhost:5432/infralens?sslmode=disable"

🔬 Under the Hood

eBPF Probes

Probe	Purpose	Direction
`kprobe(+ret)/tcp_v4_connect`	Outbound IPv4 connections	Outbound
`kprobe(+ret)/tcp_v6_connect`	Outbound IPv6 connections	Outbound
`kretprobe/inet_csk_accept`	Accepted (incoming) connections	Inbound
`kprobe/tcp_sendmsg`	Bytes sent	Throughput
`kprobe(+ret)/tcp_recvmsg`	Bytes received	Throughput
`kprobe/tcp_close`	Connection cleanup	Cleanup
`kprobe/udp_sendmsg` / `udpv6_sendmsg`	UDP flow discovery + bytes sent	UDP
`kprobe(+ret)/udp_recvmsg` / `udpv6_recvmsg`	UDP bytes received	UDP

Events carry a direction (0 outbound / 1 inbound) and a protocol (tcp/udp) field. UDP flows are discovered on first send — for unconnected sockets the destination is read from the syscall's msg_name. In the UI, UDP edges render dashed with an amber UDP badge.

Deep Inspection

Service Type	Detection Method	Data Collected
HTTP services	Probe `/`, `/health`, `/metrics`	Server header, endpoints, health
PostgreSQL	SSL request handshake	Version, connection status
MySQL	Protocol greeting packet	Version string
Redis	PING command	Connection status
MongoDB	Wire protocol	Connection status
Node.js / Python / Go	`package.json` / `requirements.txt` / `go.mod`	Dependencies, frameworks

Inspection is read-only by design: environment variable names only (never values), config file names only, .env and secrets always excluded, file reads capped at 50KB/200 lines.

Project structure

infralens/
├── agent/                    # eBPF Agent
│   ├── main.go              # Entry point
│   ├── bpf/                 # BPF C programs (traffic.c, CO-RE headers)
│   ├── collector/           # BPF Go bindings + event parsing
│   ├── inspector/           # Deep inspection
│   ├── metrics/             # Host monitoring
│   └── updater/             # Auto-update
├── backend/                  # Backend Server
│   ├── api/                 # HTTP handlers
│   ├── service/             # Business logic (+ demo simulator)
│   ├── storage/             # SQLite/Postgres
│   ├── k8s/                 # K8s watcher
│   └── pkg/llm/             # AI providers
├── frontend/                 # React Dashboard (React Flow + Tailwind)
├── deploy/                   # Helm chart, Docker Compose, Kustomize
└── scripts/                  # Installation scripts

API reference

Endpoint	Method	Description
`/api/v1/events`	POST	Receive connection events from agents
`/api/v1/stats`	POST	Receive throughput stats from agents
`/api/v1/metrics`	POST	Receive host metrics (CPU/RAM) from agents
`/api/v1/inspection`	POST	Receive deep inspection data from agents
`/api/v1/topology`	GET	Current service topology with node metrics
`/api/v1/topology/export`	GET	Export topology as Mermaid or DOT (`?format=mermaid\|dot`)
`/api/v1/services`	GET	List all discovered services
`/api/v1/services/{id}`	GET	Service details
`/api/v1/ws`	WebSocket	Real-time topology updates (snapshot + deltas)
`/api/v1/graph/stats`	GET	Graph statistics
`/api/v1/k8s/status`	GET	K8s watcher status
`/api/v1/ai/*`	GET/POST	AI status, config, docs generation, Q&A
`/api/v1/version`	GET	Backend version info
`/metrics`	GET	Prometheus metrics
`/health`, `/ready`	GET	Health/readiness checks

🔧 Development

git clone https://github.com/Herenn/Infralens.git
cd Infralens

# Generate BPF bindings (Linux only, needs clang/LLVM)
cd agent/collector && go generate ./... && cd ../..

# Build
go build -o infralens-agent ./agent
go build -o infralens-backend ./backend

# Frontend
cd frontend && npm install && npm run dev

Prerequisites: Go 1.24+, clang/LLVM, Node.js 20+. For agent testing: Linux kernel 5.8+ with BTF.

No Linux machine? Run the backend with DEMO_MODE=true and develop the frontend against simulated data.

Troubleshooting

"undefined: bpfObjects" — generate BPF bindings first: cd agent/collector && go generate ./...

"no BTF found for kernel" — your kernel needs BTF support; check ls /sys/kernel/btf/vmlinux

macOS development — eBPF requires Linux; use a VM, a remote server, or demo mode.

🛣️ Roadmap

🤝 Contributing

Contributions are very welcome — this project is young and there's a lot of interesting work to pick up, from eBPF probes to React Flow UX. See CONTRIBUTING.md to get started, or open an issue to discuss an idea first.

📄 License

Apache License 2.0 — see LICENSE.

🙏 Acknowledgments

cilium/ebpf — pure Go eBPF library
React Flow — graph visualization
Hubble — inspiration

If InfraLens saved you an afternoon of spelunking through your infrastructure, consider giving it a ⭐ — it helps others find the project.

Navigation Menu

Repository files navigation

🔍 InfraLens

⚡ Try It in 30 Seconds

🤔 Why InfraLens?

🎯 Features

🏗️ How It Works

🚀 Installation

Kubernetes (Helm)

Linux Servers (one-liner)

Docker Compose

🤖 AI-Powered Documentation

⚙️ Configuration

🔬 Under the Hood

eBPF Probes

Deep Inspection

🔧 Development

🛣️ Roadmap

🤝 Contributing

📄 License

🙏 Acknowledgments

About

Releases

Packages

Contributors

Languages

Name		Name	Last commit message	Last commit date
.github		.github
agent		agent
backend		backend
deploy		deploy
docs		docs
frontend		frontend
scripts		scripts
.dockerignore		.dockerignore
.gitignore		.gitignore
CHANGELOG.md		CHANGELOG.md
CONTRIBUTING.md		CONTRIBUTING.md
Dockerfile.agent		Dockerfile.agent
Dockerfile.backend		Dockerfile.backend
LICENSE		LICENSE
Makefile		Makefile
README.md		README.md
go.mod		go.mod
go.sum		go.sum

Latest commit

History

Folders and files

Repository files navigation

🔍 InfraLens

⚡ Try It in 30 Seconds

🤔 Why InfraLens?

🎯 Features

🏗️ How It Works

🚀 Installation

Kubernetes (Helm)

Linux Servers (one-liner)

Docker Compose

🤖 AI-Powered Documentation

⚙️ Configuration

🔬 Under the Hood

eBPF Probes

Deep Inspection

🔧 Development

🛣️ Roadmap

🤝 Contributing

📄 License

🙏 Acknowledgments

About

Topics

Resources

Contributing

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages