ayaFlow

A high-performance, eBPF-based network traffic analyzer written in Rust. Designed to run as a sidecarless DaemonSet in Kubernetes, providing kernel-native visibility into node-wide network traffic with minimal overhead.

Built on the Aya eBPF framework.

Architecture

Kernel:  NIC --> TC Hook (eBPF, ingress + egress) --> RingBuf
                                                        |
Userspace:                            Tokio Event Loop
                                     /       |       \
                              DashMap    SQLite     Axum HTTP
                            (live stats) (history)  (API + /metrics)

• Kernel-side: A TC (Traffic Control) classifier attached at both ingress and egress parses Ethernet/IPv4/TCP/UDP headers and pushes lightweight PacketEvent structs (with a direction tag) to a shared ring buffer.
• Userspace: An async Tokio agent polls the ring buffer, maintains live connection state in a DashMap, persists events to SQLite, and exposes a REST API with Prometheus metrics.

Features

• eBPF-native capture -- No libpcap, no privileged sidecar. Hooks directly into the kernel's traffic control subsystem.
• Sidecarless DaemonSet -- One pod per node instead of one per application pod.
• Real-time monitoring -- Live dashboard via REST API + WebSocket streaming.
• Persistent history -- SQLite storage with configurable data retention and aggregation.
• Deep L7 inspection -- Optional TLS SNI and DNS query extraction for domain-level visibility into encrypted traffic.
• Prometheus /metrics -- Native exporter for ayaflow_packets_total, ayaflow_bytes_total, ayaflow_active_connections, ayaflow_domains_resolved_total, ayaflow_deep_inspect_packets_total.
• IP allowlist -- Restrict API/dashboard access by source CIDR.

Prerequisites

• Rust: Stable + nightly toolchain
• bpf-linker: cargo +nightly install bpf-linker
• Linux kernel: >= 5.8 with BTF support (for eBPF)
• Capabilities: CAP_BPF, CAP_NET_ADMIN, CAP_PERFMON

Quick Start

Build

# Install bpf-linker (one-time)
cargo +nightly install bpf-linker

# Build everything (eBPF + userspace)
cargo xtask build

Run

# Requires root for eBPF attachment
sudo ./target/debug/ayaflow --interface eth0

Verify

curl http://localhost:3000/api/health
curl http://localhost:3000/metrics

CLI Options

Kubernetes Deployment

Deploy as a DaemonSet (see k8s/daemonset.yaml):

kubectl apply -f k8s/daemonset.yaml

The DaemonSet uses hostNetwork: true and mounts /sys/fs/bpf. Prometheus scrape annotations are included by default.

Resource Recommendations

resources:
  requests:
    memory: "32Mi"
    cpu: "50m"
  limits:
    memory: "128Mi"
    cpu: "500m"

API Reference

Project Structure

ayaflow-common/    # Shared types (no_std, used by both kernel and userspace)
ayaflow-ebpf/      # eBPF kernel program (TC classifier)
ayaflow/            # Userspace agent (Aya loader + Tokio + Axum)
xtask/              # Build orchestration (cargo xtask)
k8s/                # Kubernetes DaemonSet manifest

Performance & Footprint

Measured on a minimal VM (Ubuntu 24.04, 2 vCPU, 2 GB RAM):

The eBPF classifier is verified loaded via bpftool:

$ sudo bpftool prog show name ayaflow
430: sched_cls  name ayaflow  tag 0dabf78b3d068075  gpl
     loaded_at 2026-02-16T16:38:12+0100  uid 0
     xlated 784B  jited 576B  memlock 4096B  map_ids 76

Tested On

• OS: Ubuntu 24.04 LTS (aarch64)
• Kernel: 6.x with BTF support
• Hardware: 2 vCPU, 2 GB RAM (Lima VM)
• Rust: nightly toolchain + bpf-linker

License

This project is licensed under either of:

• Apache License, Version 2.0
• MIT license

at your option.

The eBPF kernel components (ayaflow-ebpf) are licensed under GPL to ensure compatibility with the Linux kernel verifier.