Protocol Support

Kubeshark supports a comprehensive range of network protocols across multiple layers, from low-level transport protocols to application-layer APIs.

Supported Protocols

HTTP & Web Protocols

ProtocolVersionDescription
HTTP/1.0RFC 1945Original HTTP protocol
HTTP/1.1RFC 2616Persistent connections, chunked transfer
HTTP/2RFC 7540Multiplexed streams, header compression
WebSocketRFC 6455Full-duplex communication over HTTP
GraphQLHTTP/1.1 & HTTP/2Query language for APIs

Messaging & Streaming

ProtocolDescription
Apache KafkaDistributed event streaming platform
AMQPAdvanced Message Queuing Protocol (RabbitMQ)
RedisIn-memory data structure store protocol

RPC & API Protocols

ProtocolDescription
gRPCHigh-performance RPC over HTTP/2

Authentication Protocols

ProtocolRFCDescription
LDAPRFC 4511Lightweight Directory Access Protocol
RADIUSRFC 2865Remote Authentication Dial-In User Service
DIAMETERRFC 6733Authentication, Authorization, and Accounting

Network & Transport Layer

ProtocolRFCDescription
TCPRFC 9293Transmission Control Protocol
UDPRFC 768User Datagram Protocol
SCTPRFC 4960Stream Control Transmission Protocol
DNSRFC 1035Domain Name System
ICMPRFC 792Internet Control Message Protocol

Security Protocols

ProtocolDescription
TLSTransport Layer Security with automatic decryption

TLS Decryption

Kubeshark captures TLS traffic in clear text by hooking into the cryptographic libraries used by applications — without requiring access to private keys. Using eBPF, it intercepts data after decryption (on read) and before encryption (on write), capturing the plain text directly from memory.

Supported Libraries

LibraryLanguages / RuntimesRequirement
OpenSSLPython, Java, PHP, Ruby, Node.jsLinked as shared library
Go crypto/tlsGo servicesNon-stripped binaries
BoringSSLgRPC, Chrome, EnvoyLinked as shared library

If your application uses one of these libraries for TLS termination, Kubeshark can display the traffic in clear text.

How It Works

Kubeshark traces both kernel-space and user-space functions using eBPF — an in-kernel virtual machine that runs programs passed from user space.

  • OpenSSL — attaches uprobes to SSL_read and SSL_write, capturing unencrypted data in any TLS/SSL connection. Covers Python, Java, PHP, Ruby, and Node.js.
  • Go — probes crypto/tls.(*Conn).Read and crypto/tls.(*Conn).Write. Supports both amd64 and arm64 with ABI0 and ABIInternal. Uses Capstone for binary disassembly and DWARF tables for Goroutine tracking.
  • Kernel — uses kprobes for address resolution and request-response matching.

These methods have minimal performance impact. The Linux kernel limits the number of eBPF instructions allowed for probing, ensuring no significant slowdown.

Service Mesh Integration

Kubeshark integrates with service mesh solutions, displaying mTLS-encrypted traffic in plaintext:

How Protocol Indexing Works

  1. Capture: eBPF and AF_PACKET capture Layer 4 traffic (TCP, UDP, SCTP)
  2. Identify: Protocol identification based on port numbers and payload inspection
  3. Dissect: Protocol-specific parsing reconstructs application-layer messages
  4. Enrich: Traffic is enriched with Kubernetes context (pods, services, namespaces)

If Kubeshark cannot identify the protocol, the traffic is still available at the L4 level with full Kubernetes and network context. Only the API context is missing. See L4 to L7 & PCAP Viewer for details.

Learn about capture filters →