Kentik Labs Launches With Open Source Networking Tools Leveraging eBPF

Kentik, an 8-year-old San Francisco-based software-as-a-service network observability company, has made some tools for observing network traffic open source. At the same time, the company has created Kentik Labs as a platform for accessing these tools as well as for getting help with their use.

This will help developers, DevOps teams and site reliability engineering folks observe the traffic within their cloud-native networks to diagnose problems such as bottlenecks that might be slowing down their operations. 

"As a company, we traditionally sell to network engineers, or that side of the house: people who are concerned with who their top talkers are, where their traffic is going, cost optimization in terms of making sure that high-cost traffic is going through CDNs as opposed to expensive transit, and things like that," Nick Stinemates, Kentik's vice president of business development (and co-chair of the new Kentik Labs), told Data Center Knowledge. "The Labs' effort is about democratizing that concept to different user types, like developers, DevOps and traditional sys admins."

Networking engineers like Kentik's SaaS platform because it takes advantage of eBPF (Extended Berkeley Packet Filter), a feature that began being added to Linux in 2014, allowing programs to be run within a sandbox from inside the Linux kernel. This gives programs the ability to do things that aren't possible in user space, such as directly accessing the struct files used by drivers and the like, which aren't directly accessible by user programs. This avoids having to use pcap, an API for capturing network traffic that can put a noticeable load on a server's CPU.

"It's basically a little program that you'd run on your server," Ian Pye, a co-founder and director of engineering at Kentik, told us. "It knows about Docker containers, so it's showing you all the containers that are running and who they're talking to."

Not Open Sourcing Its SaaS Tools

Kentik Labs launched with five open source tools that, like its SaaS platform, can help with observing the flow of traffic between apps within a network: kTranslate, for pulling and pushing network data; NetDiag, for low-level network diagnostics such as ping and trace (along with a custom diagnostic tool called knock); Convis, which is example code showing how to use eBPF to attribute process and container information to network traffic; kProbe, a high-performance host and sensor network probe; and Grafana App, for ingesting and querying network data in real time.

While these tools perform functions similar to what's available on the company's SaaS platform, they're not necessarily exactly the same.

"It's more like spiritual derivatives, if you will," Stinemates said. "In some cases, like kProbe, it's being used as a part of our our SaaS offering, but Convis, as an example, is not the eBPF agent [we use]. Some of it's related, but ... it's a loose tie-in."

Stinemates, whose background is in open source (he was part the original dotCloud team, the pioneering container company that changed its name to Docker in 2013), said the purpose behind Kentik Labs is to build a community of open source users and developers around their technology, and not as a method to sell their commercial SaaS platform.

"It's completely disjointed from our commercial operations," he said. "That's the only way to participate credibly in the open source community: to truly have a spirit of giving and learning, and doing all of this in the open, as opposed to it being a Trojan horse for your commercial products."

Kentik Labs is free for anyone to access and use. The project has a website that can be used to access all of the projects, which are available on GitHub. In addition, there is also a community Slack channel where members can not only swap information with other users and developers, but also can connect with Kentik's IT staff.