1.
Open source network and application tracing
Monica Sarbu & Tudor Golubenco

2.
• Sniffs and dissects packets on the network
• { “method”: “GET”, “path”: “/users/“, “status”:
“OK”, “http.code”: 200, “http.phrase”: “OK” …}
• {“responsetime”: 12000, “bytes_out”: 578 …}
• {“service”: “Service15”, “host”: “alpha” … }
• Inserts this data in Elasticsearch

3.
Imagine having the Firebug network tab not
only when developing
but also in production

4.
For all users, all the time

5.
And between servers as well
even between processes on the same host

6.
All of this with history, indexed and searchable
So you can troubleshoot an error from
yesterday

7.
Visualise your topology

8.
Visualise response times

9.
Find problematic hosts / URLs / queries /
services / methods / …

10.
Compare different services / servers / URLs /
methods / …
Graphs have sub-second resolution

11.
Protocol support
• HTTP
• MySQL
• PostgreSQL
• REDIS
• Thrift-RPC
• DNS
• Memcache
• Oracle
• MSSQL
• Sybase
• MongoDB
• Cassandra
soon™:

12.
Plans for 2015
• New inputs (besides sniffing):
• Middleware agents for Revel, Martini, Rails, Django
• JVM byte-code-injection agent
• API gateway for 3rd party services
• Y! Boomerang for RUM
• Nginx/Apache log files
• Your own instrumentation code

13.
processorsinputs outputs

14.
Normalise URLs / Queries
Obfuscate parameters
• Transforms:
• SELECT * FROM table WHERE
name=“Foobar” AND value=123;
• To
• SELECT * FROM table WHERE name=[S8]
AND value=[N128];

15.
We’re hiring*
• http://packetbeat.com
• @packetbeat
*We’re not paying