qtap

es, no code changes. It works by hooking into TLS libraries (OpenSSL, Go crypto, Java SSL, Node.js, etc) via eBPF before encryption happens. Getting started: # Option A: Install script (inspect it first if you prefer) curl -s https://get.qpoint.io/install | less curl -s https://get.qpoint.io/install | sudo sh sudo qtap --enable-dev-tools If you're (rightly) skeptical of curl | sh, grab the binary directly or build from source. We get it. # Option B: Direct binary download (use the link for your architecture) curl -L https://downloads.qpoint.io/qpoint/qtap-latest-linux-amd64.tgz -o qtap.tgz # curl -L https://downloads.qpoint.io/qpoint/qtap-latest-linux-arm64.tgz -o qtap.tgz tar -xzf qtap.tgz sudo ./qtap --enable-dev-tools Then open http://localhost:10001 # For remote servers, use SSH port forwarding or Tailscale/Twingate ssh -L 10001:localhost:10001 user@remote-server Key features: - Process/container attribution (which container made that call?) - Real-time SSE streaming - Copy any request as cURL - Data never leaves your machine DevTools is free and open source (AGPL-3.0). GitHub: https://github.com/qpoint-io/qtap Docs: https://docs.qpoint.io/release-notes/devtools Questions we'd love feedback on: - What debugging scenarios would you use this for? - Any protocols beyond HTTP you'd want? (Postgres, MySQL, Redis coming soon)

qtap. It's a lightweight agent that uses eBPF to tap into network traffic at the kernel level. The key idea is to hook into common TLS libraries (like OpenSSL) before encryption and after decryption. This gives us deep visibility into the actual request/response payloads of HTTPS/TLS traffic without needing to terminate the connection or manage certs. Because it leverages eBPF, the performance impact is minimal compared to traditional methods. With qtap, we can now see exactly which external services our apps are talking to, inspect the payloads for debugging or security auditing (e.g., spotting accidental PII leaks), monitor API performance/errors for third-party dependencies, and get a much clearer picture of our egress traffic patterns. We've found this approach really powerful for improving reliability and security posture. We've packaged qtap as a Linux Binary, Docker container, and Helm chart for deployment. This is still evolving, but we're excited about the potential of using eBPF for this kind of deep, yet non-intrusive, visibility. We'd love to get the HN community's feedback: Do you face similar challenges monitoring encrypted egress traffic? What are your thoughts on using eBPF for this compared to other methods? Any suggestions or potential use cases we haven't considered? Happy to answer any questions!