Infralens

🔍 InfraLens

See every connection in your infrastructure — without touching a single line of code.

InfraLens uses eBPF to discover and visualize service-to-service communication in real time, on Kubernetes clusters and plain Linux servers. No sidecars. No SDKs. No instrumentation.

Try the demo · Install · How it works · Features · Contributing

⚡ Try It in 30 Seconds

No Linux, no eBPF, no agents — demo mode simulates a realistic multi-node topology with live traffic. Works on macOS, Windows, and Linux:

git clone https://github.com/Herenn/Infralens.git
cd Infralens/deploy/docker-compose
docker compose -f demo.yml up -d

Open http://localhost:3000 — you’ll see servers, services, live throughput, and UDP flows. Click any node to inspect it, press / to search.

🤔 Why InfraLens?

You inherit a cluster, or your architecture diagram is six months stale, and the question is always the same: what actually talks to what? Traditional APM answers it by making you instrument every service. Service-mesh tools answer it if you’re willing to run a mesh.

InfraLens answers it from the kernel — deploy the agent, and every TCP connection and UDP flow on the box appears on a live map within seconds.

	InfraLens	Traditional APM	Service Mesh Observability
Code changes required	None	SDK in every service	None
Infrastructure required	One agent per node	Agents + config per app	Full mesh (sidecars/CNI)
Works outside Kubernetes	Yes — any Linux server	Varies	No
Sees non-HTTP traffic (DBs, queues, DNS)	Yes — TCP + UDP at kernel level	Only instrumented calls	Mostly yes
Explains unknown services	Yes — fingerprinting + AI docs	No	No
Time to first insight	Seconds	Days–weeks	Days

🎯 Features

See everything

• 🕸️ Live topology map — services grouped by server, edges showing real-time throughput, rendered with React Flow
• 🌐 TCP + UDP, IPv4 + IPv6 — outbound, inbound, and UDP flows (DNS, StatsD, syslog) traced at the kernel with <1% CPU overhead
• 📊 Host metrics — per-server CPU/RAM bars, bytes/packets per connection with live rates

Understand it

• 🔎 Service fingerprinting — PostgreSQL, Redis, Nginx, Kafka, and dozens more identified from ports and process names
• 🧠 AI-generated docs — click any service and get architecture, security, and performance analysis (OpenAI, Anthropic, Gemini, or fully local via Ollama/LM Studio)
• 🔬 Deep inspection — protocol probing (HTTP headers, DB handshakes), dependency discovery from package.json / go.mod / requirements.txt
• ⌨️ Search & export — find any node instantly (/), export the graph as PNG, JSON, Mermaid, or Graphviz DOT

Run it anywhere

• ☸️ Kubernetes native — DaemonSet + RBAC, automatic IP → Pod/Service name resolution via client-go informers
• 🖥️ Plain Linux servers — one-line installer, systemd service, multi-node agents reporting to one backend
• 🔒 Production ready — API-key agent auth, HTTPS support, SQLite/PostgreSQL persistence, Prometheus /metrics, CO-RE portability across kernels 5.8+
  What’s new in v2.0.0
• Demo mode — try InfraLens without Linux/eBPF/agents (DEMO_MODE=true)
• UDP tracing — DNS, StatsD, and other UDP flows with dashed edges and protocol badges
• Topology search — by name, IP, technology, or node
• Delta WebSocket updates — incremental updates instead of full snapshots every 2s
• Graph export — Mermaid and Graphviz DOT
• Working agent auth — --api-key / INFRALENS_API_KEY + HTTPS backend URLs
• Proxy-friendly frontend — same-origin URLs work behind any ingress/TLS

See CHANGELOG.md for the full history.

🏗️ How It Works

flowchart TB
    subgraph infra["Your Infrastructure"]
        A[Service A] --> B[Service B]
        B --> C[Service C]
        A --> C
    end

    subgraph ebpf["Kernel Space"]
        trace[eBPF Probes<br/>tcp_connect / accept / send / recv / udp_sendmsg]
    end

    subgraph agent["InfraLens Agent"]
        collector[Collector<br/>Event Parsing]
        inspector[Deep Inspector]
        metrics[Host Metrics]
    end

    subgraph backend["InfraLens Backend"]
        api[REST API]
        ws[WebSocket<br/>delta updates]
        db[(SQLite/Postgres)]
        ai[AI Providers]
    end

    subgraph frontend["InfraLens Frontend"]
        react[React Flow<br/>Topology View]
    end

    infra -.->|kernel tracing| ebpf
    ebpf --> agent
    agent -->|HTTP POST| backend
    backend <-->|real-time| frontend

1. Agent (one per node) attaches eBPF probes to kernel functions like tcp_v4_connect and udp_sendmsg, capturing every connection with process context — no packet capture, no proxies.
2. Backend aggregates events from all agents, resolves Kubernetes IPs to Pod/Service names, fingerprints services, and persists to SQLite or PostgreSQL.
3. Frontend renders the live topology over a delta-based WebSocket, with search, filters, drill-down drawers, and AI documentation.

🚀 Installation

Kubernetes (Helm)

helm install infralens ./deploy/helm/infralens -n infralens --create-namespace \
  --set ingress.enabled=true \
  --set backend.auth.apiKey="$(openssl rand -hex 32)"

Linux Servers (one-liner)

# Full stack (main server)
curl -sSL https://raw.githubusercontent.com/Herenn/Infralens/main/scripts/install-full.sh | sudo bash

# Agent only (each additional server)
curl -sSL https://raw.githubusercontent.com/Herenn/Infralens/main/scripts/install-agent.sh | sudo bash -s -- --backend=YOUR_BACKEND_IP:8080

Docker Compose

cd deploy/docker-compose
cp env.example .env   # optional: API keys, auth
docker compose up -d

Dashboard: http://localhost:3000

Requirements for real tracing: Linux kernel 5.8+ with BTF (ls /sys/kernel/btf/vmlinux must exist — default on Ubuntu 20.04+, Debian 11+, Fedora 31+). The agent is CO-RE: compile once, run on any supported kernel. No kernel requirements for demo mode.

🤖 AI-Powered Documentation

Click any service → AI Docs → get a generated explanation of what the service does, its tech stack, network behavior, security considerations, and recommendations — built from its network topology, protocol probes, runtime metrics, and (optionally) project files like README and Dockerfile.

Provider	Type	Default Model
OpenAI	Cloud	GPT-3.5-turbo
Anthropic	Cloud	Claude 3 Haiku
Google Gemini	Cloud	Gemini Pro
Ollama	Local	Llama2
LM Studio	Local	Any compatible

🔒 Privacy first: only non-sensitive files (README, Dockerfile, package manifests) are used for context, on-demand, never stored. .env files and secrets are always excluded. Use Ollama/LM Studio to keep everything on your own hardware.

⚙️ Configuration

Common settings (see the full reference below):

DEMO_MODE=true                  # Simulated topology, no agents needed
DB_DRIVER=postgres              # sqlite (default) or postgres
API_KEY=$(openssl rand -hex 32) # Require agent authentication
CORS_ORIGINS=https://infralens.example.com

Agents authenticate with --api-key (or INFRALENS_API_KEY) and support HTTPS backends:

sudo ./infralens-agent --backend=https://infralens.example.com --api-key="your-secret-key"

All environment variables

# ── Server ──────────────────────────────────────────────
LISTEN_ADDR=:8080              # HTTP listen address
DEBUG=false                    # Enable debug logging
DEMO_MODE=false                # Simulate a live topology (no agents needed)
READ_TIMEOUT=15s               # HTTP read timeout
WRITE_TIMEOUT=15s              # HTTP write timeout

# ── Database ────────────────────────────────────────────
DB_DRIVER=sqlite               # Database driver: sqlite or postgres
DB_DSN=infralens.db            # SQLite: file path, Postgres: connection string
DB_AUTO_MIGRATE=true           # Run migrations on startup
DB_MAX_OPEN_CONNS=25           # Max open connections (default: 1 for SQLite, 25 for Postgres)
DB_MAX_IDLE_CONNS=5            # Max idle connections
DB_CONN_MAX_LIFETIME=5m        # Connection max lifetime

# ── Data pruning ────────────────────────────────────────
PRUNE_INTERVAL=5m              # How often to prune stale data (0 to disable)
PRUNE_MAX_AGE=30m              # Delete data older than this

# ── Security ────────────────────────────────────────────
API_KEY=                       # API key for agent auth (empty = disabled)
API_KEY_HEADER=X-API-Key       # Header name for API key
CORS_ORIGINS=*                 # Comma-separated allowed origins
CORS_CREDENTIALS=true          # Allow credentials in CORS

# ── AI providers ────────────────────────────────────────
OPENAI_API_KEY=sk-...          # OpenAI API key
OPENAI_MODEL=gpt-3.5-turbo
ANTHROPIC_API_KEY=sk-ant-...   # Anthropic API key
ANTHROPIC_MODEL=claude-3-haiku-20240307
GEMINI_API_KEY=AIza...         # Google Gemini API key
GEMINI_MODEL=gemini-pro
OLLAMA_URL=http://localhost:11434
OLLAMA_MODEL=llama2
LMSTUDIO_URL=http://localhost:1234
LMSTUDIO_MODEL=
DEFAULT_LLM_PROVIDER=openai

Security details: protected endpoints, CORS, databases

Protected endpoints (when API_KEY is set): POST /api/v1/events, /api/v1/stats, /api/v1/metrics, /api/v1/inspection

Public endpoints (always accessible): GET /api/v1/topology, /api/v1/services, /api/v1/ws (WebSocket), /health, /ready

CORS:

export CORS_ORIGINS="*"                                    # development
export CORS_ORIGINS="https://infralens.example.com"        # production

Databases:

# SQLite (default - development/single node)
export DB_DRIVER=sqlite
export DB_DSN=infralens.db

# PostgreSQL (production/high volume)
export DB_DRIVER=postgres
export DB_DSN="postgres://user:password@localhost:5432/infralens?sslmode=disable"

🔬 Under the Hood

eBPF Probes

Probe	Purpose	Direction
kprobe(+ret)/tcp_v4_connect	Outbound IPv4 connections	Outbound
kprobe(+ret)/tcp_v6_connect	Outbound IPv6 connections	Outbound
kretprobe/inet_csk_accept	Accepted (incoming) connections	Inbound
kprobe/tcp_sendmsg	Bytes sent	Throughput
kprobe(+ret)/tcp_recvmsg	Bytes received	Throughput
kprobe/tcp_close	Connection cleanup	Cleanup
kprobe/udp_sendmsg / udpv6_sendmsg	UDP flow discovery + bytes sent	UDP
kprobe(+ret)/udp_recvmsg / udpv6_recvmsg	UDP bytes received	UDP

Events carry a direction (0 outbound / 1 inbound) and a protocol (tcp / udp) field. UDP flows are discovered on first send — for unconnected sockets the destination is read from the syscall’s msg_name. In the UI, UDP edges render dashed with an amber UDP badge.

Deep Inspection

Service Type	Detection Method	Data Collected
HTTP services	Probe /, /health, /metrics	Server header, endpoints, health
PostgreSQL	SSL request handshake	Version, connection status
MySQL	Protocol greeting packet	Version string
Redis	PING command	Connection status
MongoDB	Wire protocol	Connection status
Node.js / Python / Go	package.json / requirements.txt / go.mod	Dependencies, frameworks

Inspection is read-only by design: environment variable names only (never values), config file names only, .env and secrets always excluded, file reads capped at 50KB/200 lines.

Project structure

infralens/
├── agent/                    # eBPF Agent
│   ├── main.go              # Entry point
│   ├── bpf/                 # BPF C programs (traffic.c, CO-RE headers)
│   ├── collector/           # BPF Go bindings + event parsing
│   ├── inspector/           # Deep inspection
│   ├── metrics/             # Host monitoring
│   └── updater/             # Auto-update
├── backend/                  # Backend Server
│   ├── api/                 # HTTP handlers
│   ├── service/             # Business logic (+ demo simulator)
│   ├── storage/             # SQLite/Postgres
│   ├── k8s/                 # K8s watcher
│   └── pkg/llm/             # AI providers
├── frontend/                 # React Dashboard (React Flow + Tailwind)
├── deploy/                   # Helm chart, Docker Compose, Kustomize
└── scripts/                  # Installation scripts

API reference

Endpoint	Method	Description
/api/v1/events	POST	Receive connection events from agents
/api/v1/stats	POST	Receive throughput stats from agents
/api/v1/metrics	POST	Receive host metrics (CPU/RAM) from agents
/api/v1/inspection	POST	Receive deep inspection data from agents
/api/v1/topology	GET	Current service topology with node metrics
/api/v1/topology/export	GET	Export topology as Mermaid or DOT (?format=mermaid|dot)
/api/v1/services	GET	List all discovered services
/api/v1/services/{id}	GET	Service details
/api/v1/ws	WebSocket	Real-time topology updates (snapshot + deltas)
/api/v1/graph/stats	GET	Graph statistics
/api/v1/k8s/status	GET	K8s watcher status
/api/v1/ai/*	GET/POST	AI status, config, docs generation, Q&A
/api/v1/version	GET	Backend version info
/metrics	GET	Prometheus metrics
/health, /ready	GET	Health/readiness checks

🔧 Development

git clone https://github.com/Herenn/Infralens.git
cd Infralens

# Generate BPF bindings (Linux only, needs clang/LLVM)
cd agent/collector && go generate ./... && cd ../..

# Build
go build -o infralens-agent ./agent
go build -o infralens-backend ./backend

# Frontend
cd frontend && npm install && npm run dev

Prerequisites: Go 1.24+, clang/LLVM, Node.js 20+. For agent testing: Linux kernel 5.8+ with BTF.

No Linux machine? Run the backend with DEMO_MODE=true and develop the frontend against simulated data.

Troubleshooting

“undefined: bpfObjects” — generate BPF bindings first: cd agent/collector && go generate ./...

“no BTF found for kernel” — your kernel needs BTF support; check ls /sys/kernel/btf/vmlinux

macOS development — eBPF requires Linux; use a VM, a remote server, or demo mode.

🛣️ Roadmap

• eBPF TCP tracing (IPv4 + IPv6) with throughput
• Kubernetes service discovery & real-time topology
• Multi-provider AI documentation
• SQLite/PostgreSQL persistence
• UDP tracing (v2.0)
• Delta-based WebSocket updates (v2.0)
• Demo mode, topology search, Mermaid/DOT export (v2.0)
• Historical time-series storage & time-travel view
• Anomaly detection & alerting
• HTTP-level (L7) request tracing
• Service mesh integration

🤝 Contributing

Contributions are very welcome — this project is young and there’s a lot of interesting work to pick up, from eBPF probes to React Flow UX. See CONTRIBUTING.md to get started, or open an issue to discuss an idea first.

📄 License

Apache License 2.0 — see LICENSE.

🙏 Acknowledgments

• cilium/ebpf — pure Go eBPF library
• React Flow — graph visualization
• Hubble — inspiration

---

If InfraLens saved you an afternoon of spelunking through your infrastructure, consider giving it a ⭐ — it helps others find the project.