Qtap

An eBPF agent that captures traffic flowing through the Linux kernel. By attaching to TLS/SSL functions, data is intercepted before and after encryption and then passed to flexible plugins with full visibility along with all of the available context - process/container/host/user/protocol/etc. Qtap makes it possible to understand what's happening with your egress traffic, without modifying apps, installing proxies, or managing certs.

Qtap shows you exactly what data is being sent and received in its original, unencrypted form while operating out-of-band with minimal overhead, without adding latency or disrupting application performance.

Qtap can augment your existing observability piplines or can be used as a foundational component for a custom solution, like Qpoint, in a variety of ways, including:

• Security auditing - Security professionals can verify sensitive data isn't being unintentionally exposed in network communications.
• Debugging network issues - When APIs return errors or connections fail, seeing the actual data being sent helps identify misconfigured parameters, malformed requests, or unexpected responses.
• API development - Developers can verify their applications are sending correctly formatted requests and properly handling responses without modifying code.
• Troubleshooting third-party integrations - When integrating with external services, Qtap helps confirm what data is actually being exchanged versus what documentation claims.
• Learning and exploration - Understanding how protocols actually work by observing real traffic between applications and services.
• Legacy system investigation - When working with poorly documented or legacy systems, Qtap provides insights into how they communicate without requiring source code access.
• Validation testing - Confirming that application changes don't unexpectedly alter network communication patterns.