Netra
See every packet's story. Contain the bad ones. Let go automatically.
Standalone eBPF network observability and emergency network control for Linux/Kubernetes — with optional Cilium + Hubble enrichment. Kernel drop attribution, path and congestion diagnostics, live packet capture, and leased deny rules that return to observe on their own, on any CNI.
Observe-first · Lease-bounded, fails open · No CNI required · No payload collection · 190 MCP tools
📖 Read the full docs — quickstart, architecture, security model, and a product tour.
What's new
From CHANGELOG.md (0.28.2 to 0.30.0):
Why Netra
Netra does not require Cilium. The node agent owns its own programs and maps below /sys/fs/bpf/netra. If Cilium/Hubble exists, Netra can manage CiliumNetworkPolicy and display Hubble flows, but both integrations are opt-in.
Netra vs Cilium + Hubble
Netra never modifies or pins over Cilium-owned BPF maps, so the two can share a cluster.
See it live
Overview, the Firewall page's unified rules table and NetPol v2 allow-list, then a real in-browser VNC console connected to a running KubeVirt VM — captured against a live lab deployment, not a mockup:
The Overview page. More screens follow in Observe, Diagnose and Contain.
How it fits together
Browser / netractl
|
v
+---------------------+
| netrad |
| API + UI + state |
+----------+----------+
|
desired config| node reports
v
+------------------------------------------------+
| netra-agent on every Linux node |
| |
| cgroup skb + socket hooks optional TCX |
| | optional XDP |
| +------ Netra maps/ring buffer ------+
| /sys/fs/bpf/netra |
+------------------------------------------------+
netrad serves HTTPS on :30870 by default. Hook model, visibility boundaries and the optional Cilium/Hubble integration: docs/architecture.md · Standalone eBPF.
Quickstart
make install # netractl → /usr/local/bin (or PREFIX=$HOME/.local)
netractl install --namespace netra-system # Helm install: controller + node agent DaemonSet
netractl status
Then open https://<node-ip>:30870 and sign in. The dashboard sits behind a login screen — see Signing in (the nav bar and login screen carry the Zyvor mark).
Requires Linux with cgroup v2 and bpffs; practical baseline Linux 5.8+ (TCX 6.6+). Run netra-doctor first. Full steps, Helm values, Cilium/Hubble and CLI examples: Install guide.
Observe
Flows with pod and owner attribution, TCP health, DNS, TLS SNI and HTTP Host metadata, behavior baselines and drift. Live Hubble flows when Cilium is present. Capabilities →
Diagnose
TCP path diagnostics measure connect latency and transport pressure per workload, plus edge-observed handshake and RTT histograms that see NAT'd flows. Path → · Edge intel →
Congestion Map colors every layer of the Linux network stack by its worst finding, cluster-wide. One click jumps to a capture on the offending node. Kernel diagnostics →
Packet Capture streams a filtered, time-bounded capture live, color-coded by protocol, with a Wireshark-style layered decode and hex dump. Opt-in auto-capture persists PCAPs on critical findings. Capture →
A Congestion Map finding to a live, decoded, color-coded capture on the offending node:
Drop Explain answers "why was this dropped?" with kernel reasons and policy context. Drop diagnostics → · Drop info →
More: DNS, ICMP, behavior and rate insights.
Monitor
Per-second metrics, zero config. Every node streams host, network stack, conntrack, cgroup, process-group, eBPF datapath and per-workload RED series to the controller, kept at 1 s for an hour, 1 min for two weeks and 1 h for a year. The Metrics page charts every context live, with an anomaly ribbon on each chart. Metrics →
- Anomaly detection on every dimension (unsupervised k-means, stdlib Go), plus "what changed here" ranking for any time range you drag across. Anomalies →
- Metric alerts with Netdata-style rules and hysteresis, over 40 built in (CPU, memory, disk, interfaces, TCP, conntrack, workload RED, eBPF drops), sent through your existing Slack, webhook or PagerDuty channels. Alerts →
- Evidence behind every chart: a spike links straight to the flows, drop reasons, TCP/DNS/HTTP boards and captures from the same window. Metrics and packets in one place.
- App collectors for nginx, Apache, HAProxy, Redis, memcached, Envoy, CoreDNS, etcd and any Prometheus endpoint, with optional discovery. Apps →
- Export to Prometheus remote write, OTLP or Graphite, and a read-only fleet roll-up across clusters.
Collectors are read-only, process groups use the kernel comm only (never argv or environment), and alerts never touch enforcement.
Contain
Deny by IP, CIDR, port, DNS name, TLS SNI, UID or process, scoped to a namespace, pod, owner or label. Preview the blast radius first. Policy apply stays plan-token + risk confirm. Firewall page →
With Cilium enabled, Pods and VMs get one-click lock down / unlock through the same plan → receipt → apply path:
Safe by design
Details: Architecture and visibility boundaries · Safety and persistence.
For AI agents and operators
netractl— the operator CLI. Docs →- Security review — DNS QTYPE, versioned threat feeds with TTL/rollback and optional HTTPS refresh, flat deny-predicate suggestions, and exact-workload security correlation. Docs →
- MCP server — 190 stdio tools (130 read, 60 opt-in mutating) for AI agents. Docs →
- MCP Registry:
io.github.zyvorai/netra(live since v0.30.1), imageghcr.io/zyvorai/netra-mcp:0.32.0. Install and use →
- MCP Registry:
- Built-in AI briefs — heuristic by default, optional OpenAI-compatible rewrite, read-only. Docs →
- Export — SIEM (CEF, syslog, JSONL, OTLP), Prometheus (scrape and remote write), Grafana, Loki, Graphite, Slack and Teams ChatOps.
Netra or PacketWolf?
Netra and PacketWolf cover the same eBPF territory from opposite directions. They are counterparts, not a wired pipeline.
Rules: docs/packetwolf.md · Suite placement.
Documentation map
Maturity
Netra's latest release is 0.32.0 (CHANGELOG.md). Shipped observe and leased-control surfaces are GA. The table below says what runs by default versus what stays opt-in for privacy or safety (architecture):
Part of the Zyvor stack
License
Netra is source-available under the Zyvor Production License v1.0 (SPDX LicenseRef-Zyvor-Production-1.0, also in LICENSES/).
- Free for evaluation, development, testing, research, education, non-production labs and all other non-production use.
- Production use requires an annual enterprise subscription. Plans, support levels and terms: docs/SUBSCRIPTION-MODEL.md · Enterprise pricing · Pricing · [email protected].
Contributions: CONTRIBUTING.md. Report vulnerabilities privately per SECURITY.md.