How zero-touch capture works

Diting changes no application code and injects nothing into the application process. Signals come from three places: the kernel, the network protocols and the runtime itself.

Two capture lanes

tc_ebpf: packet capture at the network layer, for high throughput
socket_syscall: capture at the syscall layer, which keeps process-to-socket identity

With both lanes running, the agent deduplicates by socket claim so the same L7 payload is not counted twice. If a lane is unavailable, the other takes over.

Protocol parsing

L7 parsing happens inside the agent and covers 18 protocol families:

HTTP/1, HTTP/2, gRPC
MySQL, PostgreSQL, Oracle, ClickHouse, MongoDB
Redis, Kafka, RocketMQ, AMQP, MQTT, ZooKeeper
Dubbo, S3, DNS, TLS

Only structured fields leave the host. Raw payloads do not have to.

TLS plaintext

Go and OpenSSL plaintext is read through uprobes. It is opt-in with resource caps. On old kernels only classic SSL_read and SSL_write are supported; _ex hooks are reported as skipped.

Container identity

Identity comes from cgroups:

cgroup v2
cgroup v1
hybrids
Docker and kubepods layouts

Container ID, pod and namespace are attached to every record for correlation.

Frontend sessions

Replay needs no frontend changes. The agent injects the RUM script at the nginx or container layer. Coverage is visible per application in the console.

Boundaries

Strong-isolation runtimes such as gVisor and Kata are not supported
Hosts without root get partial capability
Business events that only exist if you change code are not invented for you

Degradation

Any failed capability leaves the agent running and explains itself in the heartbeat and /kernel-capabilities. This rule applies to every lane.