{"owner":"hengyoush","repo":"kyanos","hasSkills":true,"hasMcp":false,"mcpConfig":null,"found":["AGENTS.md"],"skills":{"AGENTS.md":"# Kyanos AGENTS.md\n\n> This file provides AI agents with project background, structure, coding conventions, and workflow information.\n\n## Project Overview\n\n**Kyanos** is an eBPF-based network troubleshooting tool for capturing and analyzing network requests (HTTP, Redis, MySQL, etc.), helping to quickly diagnose network-related issues such as slow queries, high traffic, and anomalies.\n\n### Core Features\n\n1. **Traffic Filtering**: Multi-dimensional filtering by process/container, L7 protocol, request/response size, latency, etc.\n2. **Traffic Analysis**: Aggregated metrics for rapid issue identification (e.g., finding largest responses when bandwidth is saturated)\n3. **Kernel-level Latency Details**: Visual representation of packet journey from NIC to socket buffer\n4. **Automatic SSL Decryption**: Automatic HTTPS traffic decryption to plaintext\n5. **Zero Dependencies**: Single binary file with command-line interface\n\n### Technology Stack\n\n- **Language**: Go 1.23+\n- **Kernel Technology**: eBPF (using cilium/ebpf library)\n- **UI**: Charmbracelet ecosystem (Bubble Tea, Bubbles, Lipgloss)\n- **CLI**: Cobra + Viper\n- **Supported Protocols**: HTTP, Redis, MySQL, Kafka, MongoDB, RocketMQ, DNS\n\n---\n\n## Project Structure\n\n```\nkyanos/\n├── main.go                 # Entry point, calls cmd.Execute()\n├── go.mod                  # Go dependency management\n├── Makefile               # Build scripts\n├── bpf/                   # eBPF C programs and headers\n│   ├── pktlatency.bpf.c   # Main eBPF program\n│   ├── openssl_*.bpf.c    # OpenSSL uprobes for various versions\n│   ├── gotls.bpf.c        # Go TLS uprobe\n│   ├── *.h                # BPF header files\n│   └── loader/            # BPF loader (Go)\n├── cmd/                   # CLI command definitions\n│   ├── root.go            # Root command and global flags\n│   ├── watch.go           # watch subcommand\n│   ├── stat.go            # stat subcommand\n│   └── *.go               # Other protocol commands\n├── agent/                 # Core Agent logic\n│   ├── agent.go           # Agent startup and main loop\n│   ├── conn/              # Connection management, event handling\n│   ├── protocol/          # Protocol parsers\n│   ├── analysis/          # Traffic analysis\n│   ├── render/            # UI rendering\n│   └── metadata/          # Container/K8s metadata\n├── common/                # Shared utilities and types\n│   ├── log.go             # Logging system\n│   ├── utils.go           # General utilities\n│   └── *.go\n├── version/               # Version information\n├── vmlinux/               # vmlinux.h for different architectures\n├── libbpf/                # libbpf submodule\n└── docs/                  # Documentation\n```\n\n---\n\n## Build System\n\n### Dependencies\n\n- **Go**: 1.23+\n- **Clang**: 10.0+\n- **LLVM**: 10.0+\n- **Linux Headers**: linux-tools-common, linux-tools-generic\n- **Others**: pkgconf, libelf-dev\n\n### Common Build Commands\n\n```bash\n# Development build (local testing)\nmake build-bpf && make\n\n# Full build with BTF (for older kernels)\nmake build-bpf && make btfgen BUILD_ARCH=x86_64 ARCH_BPF_NAME=x86 && make\n\n# Debug build\nmake kyanos-debug\n\n# Run tests\nmake test\n\n# Format code\nmake format\n```\n\n### BPF Code Generation\n\nThe project uses `go generate` to generate BPF skeleton code:\n\n```bash\n# Defined in bpf/loader/loader.go\n//go:generate go run github.com/cilium/ebpf/cmd/bpf2go ...\n\nTARGET=amd64 go generate ./bpf/  # x86_64\nTARGET=arm64 go generate ./bpf/  # arm64\n```\n\n---\n\n## Coding Conventions\n\n### Go Style Guidelines\n\n1. **Package Naming**: All lowercase, short and meaningful, avoid underscores\n2. **File Naming**: All lowercase, use underscores for separation, e.g., `kern_event_handler.go`\n3. **Interface Naming**: Verb + Noun, e.g., `ProtocolStreamParser`\n4. **Error Handling**: Explicit handling, use `common.DefaultLog` for logging\n5. **Logging**: Use dedicated loggers like `common.AgentLog`, `common.BPFLog`\n\n### Key Patterns\n\n#### Agent Startup Flow\n\n```go\n// agent/agent.go: SetupAgent()\n1. Check BPF permissions (CAP_BPF)\n2. Initialize ConnManager\n3. Initialize ProcessorManager\n4. Load BPF programs (loader.LoadBPF)\n5. Start event pulling goroutines\n6. Start rendering UI\n```\n\n#### Protocol Parser\n\n```go\n// agent/protocol/protocol.go\n\n// Implement ProtocolStreamParser interface\ntype ProtocolStreamParser interface {\n    Match(reqStreams, respStreams) []Record\n    FindBoundary(streamBuffer, messageType, startPos) int\n    ParseRequest(streamBuffer, messageType) *ParsedMessage\n    // ...\n}\n\n// Register parser\nfunc init() {\n    ParsersMap[bpf.AgentTrafficProtocolTKProtocolXXX] = func() ProtocolStreamParser {\n        return &XXXStreamParser{}\n    }\n}\n```\n\n#### eBPF Map Definition\n\n```c\n// bpf/pktlatency.bpf.c\nstruct {\n    __uint(type, BPF_MAP_TYPE_HASH);\n    __uint(key_size, sizeof(struct sock_key));\n    __uint(value_size, sizeof(struct conn_id_s_t));\n    __uint(max_entries, 65535);\n} sock_key_conn_id_map SEC(\".maps\");\n```\n\n---\n\n## Testing\n\n### Test Structure\n\n```\nagent/\n├── agent_test.go              # Agent tests\n├── agent_utils_test.go        # Utility tests\n└── protocol/\n    └── http_test.go           # Protocol parser tests\n```\n\n### Running Tests\n\n```bash\n# All tests\ngo test -v ./...\n\n# Specific package tests\ngo test -v ./agent/...\n\n# Benchmark tests\ngo test -bench=. ./...\n```\n\n---\n\n## Troubleshooting\n\n### 1. BPF Loading Failed\n\n- Check kernel version (requires 3.10.0-957+ or 4.14+)\n- Check if BTF is enabled: `zgrep CONFIG_DEBUG_INFO_BTF /proc/config.gz`\n- Use `--btf` flag to specify external BTF file\n\n### 2. Container-related Features Not Working\n\n- Ensure access to Docker/Containerd/CRI\n- Use `--docker-address`, `--containerd-address` to specify endpoints\n\n### 3. SSL Decryption Failed\n\n- Check if OpenSSL version is supported\n- Ensure the process has ptrace permissions\n\n---\n\n## Contributing\n\n### Adding New Protocol Support\n\n1. Add protocol detection logic in `bpf/protocol_inference.h`\n2. Create parser in `agent/protocol/` implementing `ProtocolStreamParser`\n3. Add corresponding subcommand in `cmd/`\n4. Add test cases\n\n### Modifying BPF Code\n\n1. Modify `.c` or `.h` files\n2. Run `make build-bpf` to regenerate skeleton code\n3. Test and verify\n\n---\n\n## Resources\n\n- **Documentation**: https://kyanos.io/\n- **GitHub**: https://github.com/hengyoush/kyanos\n- **FAQ**: https://kyanos.io/faq.html\n- **eBPF Reference**: https://ebpf.io/\n- **Cilium eBPF**: https://github.com/cilium/ebpf\n\n---\n\n## Related Projects\n\nKyanos development was inspired by the following projects:\n\n- [eCapture](https://ecapture.cc/zh/) - SSL capture\n- [pixie](https://github.com/pixie-io/pixie) - K8s observability\n- [ptcpdump](https://github.com/mozillazg/ptcpdump) - Process-level tcpdump\n"},"files":{"AGENTS.md":"# Kyanos AGENTS.md\n\n> This file provides AI agents with project background, structure, coding conventions, and workflow information.\n\n## Project Overview\n\n**Kyanos** is an eBPF-based network troubleshooting tool for capturing and analyzing network requests (HTTP, Redis, MySQL, etc.), helping to quickly diagnose network-related issues such as slow queries, high traffic, and anomalies.\n\n### Core Features\n\n1. **Traffic Filtering**: Multi-dimensional filtering by process/container, L7 protocol, request/response size, latency, etc.\n2. **Traffic Analysis**: Aggregated metrics for rapid issue identification (e.g., finding largest responses when bandwidth is saturated)\n3. **Kernel-level Latency Details**: Visual representation of packet journey from NIC to socket buffer\n4. **Automatic SSL Decryption**: Automatic HTTPS traffic decryption to plaintext\n5. **Zero Dependencies**: Single binary file with command-line interface\n\n### Technology Stack\n\n- **Language**: Go 1.23+\n- **Kernel Technology**: eBPF (using cilium/ebpf library)\n- **UI**: Charmbracelet ecosystem (Bubble Tea, Bubbles, Lipgloss)\n- **CLI**: Cobra + Viper\n- **Supported Protocols**: HTTP, Redis, MySQL, Kafka, MongoDB, RocketMQ, DNS\n\n---\n\n## Project Structure\n\n```\nkyanos/\n├── main.go                 # Entry point, calls cmd.Execute()\n├── go.mod                  # Go dependency management\n├── Makefile               # Build scripts\n├── bpf/                   # eBPF C programs and headers\n│   ├── pktlatency.bpf.c   # Main eBPF program\n│   ├── openssl_*.bpf.c    # OpenSSL uprobes for various versions\n│   ├── gotls.bpf.c        # Go TLS uprobe\n│   ├── *.h                # BPF header files\n│   └── loader/            # BPF loader (Go)\n├── cmd/                   # CLI command definitions\n│   ├── root.go            # Root command and global flags\n│   ├── watch.go           # watch subcommand\n│   ├── stat.go            # stat subcommand\n│   └── *.go               # Other protocol commands\n├── agent/                 # Core Agent logic\n│   ├── agent.go           # Agent startup and main loop\n│   ├── conn/              # Connection management, event handling\n│   ├── protocol/          # Protocol parsers\n│   ├── analysis/          # Traffic analysis\n│   ├── render/            # UI rendering\n│   └── metadata/          # Container/K8s metadata\n├── common/                # Shared utilities and types\n│   ├── log.go             # Logging system\n│   ├── utils.go           # General utilities\n│   └── *.go\n├── version/               # Version information\n├── vmlinux/               # vmlinux.h for different architectures\n├── libbpf/                # libbpf submodule\n└── docs/                  # Documentation\n```\n\n---\n\n## Build System\n\n### Dependencies\n\n- **Go**: 1.23+\n- **Clang**: 10.0+\n- **LLVM**: 10.0+\n- **Linux Headers**: linux-tools-common, linux-tools-generic\n- **Others**: pkgconf, libelf-dev\n\n### Common Build Commands\n\n```bash\n# Development build (local testing)\nmake build-bpf && make\n\n# Full build with BTF (for older kernels)\nmake build-bpf && make btfgen BUILD_ARCH=x86_64 ARCH_BPF_NAME=x86 && make\n\n# Debug build\nmake kyanos-debug\n\n# Run tests\nmake test\n\n# Format code\nmake format\n```\n\n### BPF Code Generation\n\nThe project uses `go generate` to generate BPF skeleton code:\n\n```bash\n# Defined in bpf/loader/loader.go\n//go:generate go run github.com/cilium/ebpf/cmd/bpf2go ...\n\nTARGET=amd64 go generate ./bpf/  # x86_64\nTARGET=arm64 go generate ./bpf/  # arm64\n```\n\n---\n\n## Coding Conventions\n\n### Go Style Guidelines\n\n1. **Package Naming**: All lowercase, short and meaningful, avoid underscores\n2. **File Naming**: All lowercase, use underscores for separation, e.g., `kern_event_handler.go`\n3. **Interface Naming**: Verb + Noun, e.g., `ProtocolStreamParser`\n4. **Error Handling**: Explicit handling, use `common.DefaultLog` for logging\n5. **Logging**: Use dedicated loggers like `common.AgentLog`, `common.BPFLog`\n\n### Key Patterns\n\n#### Agent Startup Flow\n\n```go\n// agent/agent.go: SetupAgent()\n1. Check BPF permissions (CAP_BPF)\n2. Initialize ConnManager\n3. Initialize ProcessorManager\n4. Load BPF programs (loader.LoadBPF)\n5. Start event pulling goroutines\n6. Start rendering UI\n```\n\n#### Protocol Parser\n\n```go\n// agent/protocol/protocol.go\n\n// Implement ProtocolStreamParser interface\ntype ProtocolStreamParser interface {\n    Match(reqStreams, respStreams) []Record\n    FindBoundary(streamBuffer, messageType, startPos) int\n    ParseRequest(streamBuffer, messageType) *ParsedMessage\n    // ...\n}\n\n// Register parser\nfunc init() {\n    ParsersMap[bpf.AgentTrafficProtocolTKProtocolXXX] = func() ProtocolStreamParser {\n        return &XXXStreamParser{}\n    }\n}\n```\n\n#### eBPF Map Definition\n\n```c\n// bpf/pktlatency.bpf.c\nstruct {\n    __uint(type, BPF_MAP_TYPE_HASH);\n    __uint(key_size, sizeof(struct sock_key));\n    __uint(value_size, sizeof(struct conn_id_s_t));\n    __uint(max_entries, 65535);\n} sock_key_conn_id_map SEC(\".maps\");\n```\n\n---\n\n## Testing\n\n### Test Structure\n\n```\nagent/\n├── agent_test.go              # Agent tests\n├── agent_utils_test.go        # Utility tests\n└── protocol/\n    └── http_test.go           # Protocol parser tests\n```\n\n### Running Tests\n\n```bash\n# All tests\ngo test -v ./...\n\n# Specific package tests\ngo test -v ./agent/...\n\n# Benchmark tests\ngo test -bench=. ./...\n```\n\n---\n\n## Troubleshooting\n\n### 1. BPF Loading Failed\n\n- Check kernel version (requires 3.10.0-957+ or 4.14+)\n- Check if BTF is enabled: `zgrep CONFIG_DEBUG_INFO_BTF /proc/config.gz`\n- Use `--btf` flag to specify external BTF file\n\n### 2. Container-related Features Not Working\n\n- Ensure access to Docker/Containerd/CRI\n- Use `--docker-address`, `--containerd-address` to specify endpoints\n\n### 3. SSL Decryption Failed\n\n- Check if OpenSSL version is supported\n- Ensure the process has ptrace permissions\n\n---\n\n## Contributing\n\n### Adding New Protocol Support\n\n1. Add protocol detection logic in `bpf/protocol_inference.h`\n2. Create parser in `agent/protocol/` implementing `ProtocolStreamParser`\n3. Add corresponding subcommand in `cmd/`\n4. Add test cases\n\n### Modifying BPF Code\n\n1. Modify `.c` or `.h` files\n2. Run `make build-bpf` to regenerate skeleton code\n3. Test and verify\n\n---\n\n## Resources\n\n- **Documentation**: https://kyanos.io/\n- **GitHub**: https://github.com/hengyoush/kyanos\n- **FAQ**: https://kyanos.io/faq.html\n- **eBPF Reference**: https://ebpf.io/\n- **Cilium eBPF**: https://github.com/cilium/ebpf\n\n---\n\n## Related Projects\n\nKyanos development was inspired by the following projects:\n\n- [eCapture](https://ecapture.cc/zh/) - SSL capture\n- [pixie](https://github.com/pixie-io/pixie) - K8s observability\n- [ptcpdump](https://github.com/mozillazg/ptcpdump) - Process-level tcpdump\n"},"items":[{"name":"AGENTS.md","path":"AGENTS.md","title":"AGENTS.md","content":"# Kyanos AGENTS.md\n\n> This file provides AI agents with project background, structure, coding conventions, and workflow information.\n\n## Project Overview\n\n**Kyanos** is an eBPF-based network troubleshooting tool for capturing and analyzing network requests (HTTP, Redis, MySQL, etc.), helping to quickly diagnose network-related issues such as slow queries, high traffic, and anomalies.\n\n### Core Features\n\n1. **Traffic Filtering**: Multi-dimensional filtering by process/container, L7 protocol, request/response size, latency, etc.\n2. **Traffic Analysis**: Aggregated metrics for rapid issue identification (e.g., finding largest responses when bandwidth is saturated)\n3. **Kernel-level Latency Details**: Visual representation of packet journey from NIC to socket buffer\n4. **Automatic SSL Decryption**: Automatic HTTPS traffic decryption to plaintext\n5. **Zero Dependencies**: Single binary file with command-line interface\n\n### Technology Stack\n\n- **Language**: Go 1.23+\n- **Kernel Technology**: eBPF (using cilium/ebpf library)\n- **UI**: Charmbracelet ecosystem (Bubble Tea, Bubbles, Lipgloss)\n- **CLI**: Cobra + Viper\n- **Supported Protocols**: HTTP, Redis, MySQL, Kafka, MongoDB, RocketMQ, DNS\n\n---\n\n## Project Structure\n\n```\nkyanos/\n├── main.go                 # Entry point, calls cmd.Execute()\n├── go.mod                  # Go dependency management\n├── Makefile               # Build scripts\n├── bpf/                   # eBPF C programs and headers\n│   ├── pktlatency.bpf.c   # Main eBPF program\n│   ├── openssl_*.bpf.c    # OpenSSL uprobes for various versions\n│   ├── gotls.bpf.c        # Go TLS uprobe\n│   ├── *.h                # BPF header files\n│   └── loader/            # BPF loader (Go)\n├── cmd/                   # CLI command definitions\n│   ├── root.go            # Root command and global flags\n│   ├── watch.go           # watch subcommand\n│   ├── stat.go            # stat subcommand\n│   └── *.go               # Other protocol commands\n├── agent/                 # Core Agent logic\n│   ├── agent.go           # Agent startup and main loop\n│   ├── conn/              # Connection management, event handling\n│   ├── protocol/          # Protocol parsers\n│   ├── analysis/          # Traffic analysis\n│   ├── render/            # UI rendering\n│   └── metadata/          # Container/K8s metadata\n├── common/                # Shared utilities and types\n│   ├── log.go             # Logging system\n│   ├── utils.go           # General utilities\n│   └── *.go\n├── version/               # Version information\n├── vmlinux/               # vmlinux.h for different architectures\n├── libbpf/                # libbpf submodule\n└── docs/                  # Documentation\n```\n\n---\n\n## Build System\n\n### Dependencies\n\n- **Go**: 1.23+\n- **Clang**: 10.0+\n- **LLVM**: 10.0+\n- **Linux Headers**: linux-tools-common, linux-tools-generic\n- **Others**: pkgconf, libelf-dev\n\n### Common Build Commands\n\n```bash\n# Development build (local testing)\nmake build-bpf && make\n\n# Full build with BTF (for older kernels)\nmake build-bpf && make btfgen BUILD_ARCH=x86_64 ARCH_BPF_NAME=x86 && make\n\n# Debug build\nmake kyanos-debug\n\n# Run tests\nmake test\n\n# Format code\nmake format\n```\n\n### BPF Code Generation\n\nThe project uses `go generate` to generate BPF skeleton code:\n\n```bash\n# Defined in bpf/loader/loader.go\n//go:generate go run github.com/cilium/ebpf/cmd/bpf2go ...\n\nTARGET=amd64 go generate ./bpf/  # x86_64\nTARGET=arm64 go generate ./bpf/  # arm64\n```\n\n---\n\n## Coding Conventions\n\n### Go Style Guidelines\n\n1. **Package Naming**: All lowercase, short and meaningful, avoid underscores\n2. **File Naming**: All lowercase, use underscores for separation, e.g., `kern_event_handler.go`\n3. **Interface Naming**: Verb + Noun, e.g., `ProtocolStreamParser`\n4. **Error Handling**: Explicit handling, use `common.DefaultLog` for logging\n5. **Logging**: Use dedicated loggers like `common.AgentLog`, `common.BPFLog`\n\n### Key Patterns\n\n#### Agent Startup Flow\n\n```go\n// agent/agent.go: SetupAgent()\n1. Check BPF permissions (CAP_BPF)\n2. Initialize ConnManager\n3. Initialize ProcessorManager\n4. Load BPF programs (loader.LoadBPF)\n5. Start event pulling goroutines\n6. Start rendering UI\n```\n\n#### Protocol Parser\n\n```go\n// agent/protocol/protocol.go\n\n// Implement ProtocolStreamParser interface\ntype ProtocolStreamParser interface {\n    Match(reqStreams, respStreams) []Record\n    FindBoundary(streamBuffer, messageType, startPos) int\n    ParseRequest(streamBuffer, messageType) *ParsedMessage\n    // ...\n}\n\n// Register parser\nfunc init() {\n    ParsersMap[bpf.AgentTrafficProtocolTKProtocolXXX] = func() ProtocolStreamParser {\n        return &XXXStreamParser{}\n    }\n}\n```\n\n#### eBPF Map Definition\n\n```c\n// bpf/pktlatency.bpf.c\nstruct {\n    __uint(type, BPF_MAP_TYPE_HASH);\n    __uint(key_size, sizeof(struct sock_key));\n    __uint(value_size, sizeof(struct conn_id_s_t));\n    __uint(max_entries, 65535);\n} sock_key_conn_id_map SEC(\".maps\");\n```\n\n---\n\n## Testing\n\n### Test Structure\n\n```\nagent/\n├── agent_test.go              # Agent tests\n├── agent_utils_test.go        # Utility tests\n└── protocol/\n    └── http_test.go           # Protocol parser tests\n```\n\n### Running Tests\n\n```bash\n# All tests\ngo test -v ./...\n\n# Specific package tests\ngo test -v ./agent/...\n\n# Benchmark tests\ngo test -bench=. ./...\n```\n\n---\n\n## Troubleshooting\n\n### 1. BPF Loading Failed\n\n- Check kernel version (requires 3.10.0-957+ or 4.14+)\n- Check if BTF is enabled: `zgrep CONFIG_DEBUG_INFO_BTF /proc/config.gz`\n- Use `--btf` flag to specify external BTF file\n\n### 2. Container-related Features Not Working\n\n- Ensure access to Docker/Containerd/CRI\n- Use `--docker-address`, `--containerd-address` to specify endpoints\n\n### 3. SSL Decryption Failed\n\n- Check if OpenSSL version is supported\n- Ensure the process has ptrace permissions\n\n---\n\n## Contributing\n\n### Adding New Protocol Support\n\n1. Add protocol detection logic in `bpf/protocol_inference.h`\n2. Create parser in `agent/protocol/` implementing `ProtocolStreamParser`\n3. Add corresponding subcommand in `cmd/`\n4. Add test cases\n\n### Modifying BPF Code\n\n1. Modify `.c` or `.h` files\n2. Run `make build-bpf` to regenerate skeleton code\n3. Test and verify\n\n---\n\n## Resources\n\n- **Documentation**: https://kyanos.io/\n- **GitHub**: https://github.com/hengyoush/kyanos\n- **FAQ**: https://kyanos.io/faq.html\n- **eBPF Reference**: https://ebpf.io/\n- **Cilium eBPF**: https://github.com/cilium/ebpf\n\n---\n\n## Related Projects\n\nKyanos development was inspired by the following projects:\n\n- [eCapture](https://ecapture.cc/zh/) - SSL capture\n- [pixie](https://github.com/pixie-io/pixie) - K8s observability\n- [ptcpdump](https://github.com/mozillazg/ptcpdump) - Process-level tcpdump\n","category":"root","tokens":1674}]}