Distributed capture of remote hosts, on amd64 and arm64 alike - every image is a multi-arch manifest, so Graviton, Ampere and Apple-silicon-hosted clusters need no change.
Capture of TLS keys via eBPF - extract secrets from OpenSSL memory, from Go executables using the standard library crypto/tls (goTLS), and from Java applications (JSSE) - to decipher TLS ciphered TCP sessions, and QUIC connections. Runtimes with no hookable TLS library (rustls, static BoringSSL, Envoy/Istio sidecars - the latter not yet validated) are covered by the opt-in key log fallback: the workload writes its key log to /dev/null and Gocipher reads it from the kernel.
UDP sessions, opt-in per whisperer: datagrams grouped into UDP flows, or into request/response conversations whatever the client port, so they can be parsed like TCP sessions.
On Kubernetes: Continuous capture of the cluster network usage to enable a comprehensive network discovery
On Kubernetes: workload identity resolved at capture time - the Controller streams its live IP-to-object map to the writers, so every session and packet carries the namespace, kind, name and node Kubernetes itself would name, even after the pod IP has been reused.
A whisperer may declare its own internal CIDR ranges so its traffic is classified correctly on a private estate.
MySQL is decoded at the statement level. Text queries and prepared statements each become a communication, with bound parameters, result rows, error number and SQLSTATE, and connection user and database. The SQL is analysed into tables, output, checked and joined fields, and templates and tags name and correlate it - a ? placeholder is tagged with the value actually bound. Encrypted connections are decrypted like the other protocols.
MQTT is decoded one exchange at a time. MQTT 3.1, 3.1.1 and 5.0, over TCP or TLS: each publish with its acknowledgement, each delivery by the broker to a subscriber, each connection, subscription and disconnection becomes a communication. Every step of a QoS 1 or 2 handshake is recorded; a QoS 0 publish gets 1001 No response expected, a missing acknowledgement 1000 No response, and refused connections or subscriptions an HTTP-like error status. The client id and user name are on every message, MQTT 5 user properties are searchable, payloads are stored apart behind payload rights and decoded from JSON, Protobuf, Avro, CBOR, MessagePack and Sparkplug B. Topic templates and tags name and correlate messages, and the topic map shows who publishes and who receives.
GraphQL is read as an enrichment of the HTTP communication. Each call carries its operation (type, name, root fields, a stable query hash, variable names - never values) and its real outcome (OK, PARTIAL, ERROR, UNKNOWN) taken from the response body, whatever the HTTP status. Persisted queries, batches, and subscriptions over WebSocket (graphql-ws, subscriptions-transport-ws) and SSE (graphql-sse) are covered, one document per subscription message. See the GraphQL tab.
MCP is read the same way. Each Model Context Protocol (Streamable HTTP) call carries its JSON-RPC method, tool, prompt or resource, argument names (never values), client, session and outcome (OK, TOOL_ERROR, ERROR, INPUT_REQUIRED, UNKNOWN). Answers streamed over SSE and server-initiated messages (progress, sampling, elicitation) are described per stream message, and related messages are listed together. See the MCP tab.
DNS is decoded one question at a time. Each query and its response become one communication, over UDP, TCP, DNS over TLS and DNS over QUIC. Retransmits are counted, not duplicated; an answer without its query is still recorded; an unanswered query gets the 1000 No response status. Question, flags, EDNS and the answer, authority and additional records are searchable, and a dashboard estimates the ndots search-list noise.
HTTP/2 needs no configuration and no separate port. The framing is decided per connection from the decrypted bytes, not from the port - TLS 1.3 hides the ALPN negotiation inside EncryptedExtensions, so a port cannot tell you what it carries. One port serving HTTP/1.1 and HTTP/2 at the same time is parsed correctly on both. HPACK header compression, request/response trailers and stream multiplexing are all decoded.
HTTP/3 is decoded from QUIC, passively. The QUIC packets are decrypted with the TLS 1.3 keys Gocipher captures, then HTTP/3 frames and QPACK header compression (dynamic table included) are decoded into the same HTTP communications, with httpVersion3.0. gRPC and SSE over HTTP/3 are parsed as on HTTP/2, and a connection that moves to a new UDP flow (NAT rebinding, migration, idle gap) keeps being decoded. Turned on per Whisperer, see HTTP/3 parsing and the release post.
Message streams are decoded per message, not per connection. A WebSocket conversation or an SSE feed becomes one communication per message - own timestamp, size, payload and direction - each linked back to the request that opened it, instead of one communication whose body grows for the life of the stream.
WebSocket is read in both directions, the family's first genuinely bidirectional member.
permessage-deflate messages are inflated and readable, and socket.io v4 envelopes are decoded into packet type, namespace, event name and ack id.
Both members work over HTTP/1.1 and HTTP/2 (RFC 8441 extended CONNECT for WebSocket), recognised per stream, so a WebSocket stream, an SSE stream and ordinary requests can share one connection.
Every message can be named and tagged by its own rules, matching on the connection URI, the direction, the opcode and the payload.
Modular architecture to quickly add new protocols (1-2 weeks).
Hide proxies jumps to reveal true clients of calls.
Unified multi-protocol view (“All”) - browse HTTP/1.x, HTTP/2, GraphQL, MCP, gRPC, WebSocket, SSE, PostgreSQL, MySQL, Redis, Kafka, DNS, MQTT and MongoDB communications together in a single grid, with detail views delegating to the appropriate per-protocol view.
Kubernetes workload identity throughout the interface - as a column, a filter, an actor in the waterfall and sequence diagram, a Group by axis on the map, and a detail view of its own showing a workload's interactions and usage.
Stream messages as a first-class collection - searchable, filterable, chartable and correlatable next to every other protocol; or read one conversation end to end from the Stream Messages tab of the request that opened it.
Automatic correlation - traceparent, X-Request-ID and X-Correlation-ID extracted on HTTP, gRPC, Kafka, PostgreSQL, MySQL and MQTT 5 with nothing configured, so a fresh install links a chain on its first capture.
One click on a communication's link opens the whole chain in the unified view, shift-click opens it as a sequence diagram - across protocols, not just HTTP.
Configurable - point it at your own business tag names and communications captured months ago light up immediately.
Instantaneous creation of shared URL links to exchange your findings with your peers, and reference them in tracking systems.
Publication feature with Public links to share an analysis session to external users. With limited time and data access.
Bulk CSV export of a whole search, built server-side as a background job:
Covers HTTP, WebSocket/SSE, Redis, Kafka, gRPC, PostgreSQL, MySQL, DNS, MQTT and MongoDB, one row per payload - per record for Kafka, per reply value for Redis, per message for gRPC, per SQL statement for PostgreSQL and MySQL, per answer record for DNS, per topic filter for an MQTT subscription, per command for MongoDB.
Schema-bound Protobuf and Avro payloads are transcoded into readable columns rather than exported as raw bytes.
You are mailed when the file is ready; the CSV is kept 7 days, and its download URL is minted on click and expires five minutes later.
Your access filters apply to the file exactly as they do on screen.
Performance view, with per-session parsing phase times (build / fetch / parse) and sessions-per-batch.
Distributed agents monitoring.
OTel targets administration - a collector endpoint, its auth mode and its sealed credential, created once by an administrator and shared to teams the same way a whisperer is, so a team can push metrics without ever reading the credential.
Self-monitoring CLI (spider-mon) to query health, logs, services and parsing metrics as structured output.
Metrics export over OTLP to any OTLP/HTTP collector - the Prometheus, Grafana or OpenTelemetry Collector you already run, rather than a second console to learn:
RED metrics (spider.requests, spider.request.duration) - rate, errors and duration aggregated across the parsed protocols, grouped by client workload, server workload, protocol and endpoint.
Network usage metrics (spider.network.*) - byte counters for everything a whisperer's node sees, including UDP, DNS and protocols Spider has no parser for.
Metrics only, deliberately: Spider observes each request from outside the process, so it emits no spans it cannot honestly stitch into a trace.
Open API with complete OpenAPI v3 documentation for integration and extensions.
Service Accounts with OAuth2 authentication, specifically designed for third parties integration with the API.
MCP server - a remote Model Context Protocol endpoint at https://<your-spider>/mcp. Claude, ChatGPT and Claude Code connect with one URL and a consent screen, then search, aggregate and inspect captured traffic as the user who approved them, with that user's rights and nothing more.
Tools for identity and team selection, field reference, search, stats, outliers, aggregations, single documents, resources, private Network-View links and Kubernetes discovery. Optional time-boxed capture control, off by default.
Captured content is opt-in, size-bounded and labelled as untrusted data; links are private only.
Spider as an OAuth 2.1 authorization server for human-delegated access by third-party agents - distinct from Service Accounts, which stay the answer for machine-to-machine integration.
Dynamic client registration (open, gated or disabled) and Client ID Metadata Documents, so one agent product is one client however many users connect it.
A callback catalogue of vendors (Claude, ChatGPT, Claude Code) that administrators enable, and a Verified badge on the consent screen when the redirect host matches an enabled entry.
Opaque, revocable tokens: each connection is a grant listed under Settings > Connected apps, revocable by the user in one click, and cut off within 30 seconds.
Administrators can view, pause and delete clients with the oauthClients.create and oauthClients.delete rights.
Requires the MCP licence capability (TEAM tier and above).
Command-line interface (spider): standalone binary to query captured traffic and management resources from scripts and terminals, covering every protocol including MySQL, DNS, MQTT and MongoDB.
Low agent footprint thanks to Go: < 50MB of RAM, low CPU usage, highly scalable.
Go + Protobuf + gRPC parsing pipeline: the hot data-path services are written in Go, exchange Protobuf over gRPC, and consume far less CPU and memory than the previous Node.js + JSON + REST stack (e.g. the read service: ~10x lower memory, ~10x faster startup).
Merged poller: several data-type pollings run inside a single process instead of one pod per data type - same independent polling, a fraction of the CPU and memory.
Send feedback from the screen you are on - a defect, an idea or a question, carrying the version, the screen, the selection and your last twenty actions, shown to you as JSON before it is sent. Anonymous if you untick the reply box.
A free tier that withholds no capability. BASIC is self-hosted, does not expire, and carries the full
capability set - every protocol, TLS decryption, binary transcoding, the correlated multi-protocol timeline
and keyed PCAP-NG export - bounded by captured volume (1 TB per calendar month) rather than by features.