Cerberus
Real-time network monitor with eBPF
Get picks like this daily. Today's launch numbers, the top launches, AI and tech news, and a daily opportunity pick, straight to your inbox.
Want to reach these readers? Sponsor an issue.
Hi HN! I'm Mo, a platform engineer at Deltaflare working on critical infrastructure protection.I built Cerberus because traditional packet capture tools (tcpdump, Wireshark) have too much overhead for production CNI environments. eBPF lets us filter and classify packets at the kernel level with near-zero performance impact.Some interesting challenges: - eBPF verifier is strict - every memory access needs bounds checking - Limited to 32 bytes of L7 payload (tradeoff between inspection depth and overhead) - TC vs XDP decision (chose TC for compatibility)Looking for contributors, especially on: - Redis backend for distributed deployments - Prometheus metrics export - Anomaly detectionHappy to answer questions!
HN · launched Dec 20, 2025 · 12 upvotes (top 44%) · 0 views
Niche: network monitoring and diagnostics tools · 193 launches, 11 in the last 7 days ▼ -35% · Explore this niche →
Category and tags
- Horizontal
- Observability & eval
- Developer
- Not AI
- Hobby / open-source project
Visit website ↗ Source listing ↗
More like this: all 193 launches in network monitoring and diagnostics tools →
Could you build this?
No Real-time kernel-level packet inspection requires deep Linux systems programming, eBPF verifier compliance, and specialized networking expertise.
What it would actually take: A production version requires writing C/eBPF programs attached to XDP or TC kernel hooks, communicating with a Go or Rust userspace daemon via eBPF ring buffers. The primary challenges involve adhering to strict kernel verifier constraints, avoiding performance degradation at high packet rates, and maintaining compatibility across varied Kubernetes CNI network plugins.
Discussion
6 comments analyzed.
Competitors mentioned: Sysdig/csysdig, tcpdump, Wireshark
Concerns raised: eBPF verifier constraints complexity, Slower iteration cycle (compile-load-verify), Limited L7 inspection intentionally
Competitors
Other products that read as similar to this one : 220 launches clear the similarity bar, closest 8 shown.
Attention rank: #95 of 221 (itself plus its competitors, highest first, normalized so YC and Product Hunt are compared fairly).
Launched 51 days after the earliest competitor.
- Linnix · hn · 2025-11-11 · 21 upvotes · similarity 0.58
- Dsnitch · hn · 2026-09-06 · 5 upvotes · similarity 0.56
- skyline-speeder · github · 2026-09-18 · 95 upvotes · similarity 0.53
- BPU · hn · 2026-02-01 · 11 upvotes · similarity 0.48
- CargoWall · hn · 2026-03-31 · 14 upvotes · similarity 0.47
- pulseguard-rt · github · 2026-11-10 · 62 upvotes · similarity 0.47
- AIOStack · hn · 2026-01-14 · 9 upvotes · similarity 0.46
- An eBPF kernel guard for vTPM access · hn · 2026-10-04 · 5 upvotes · similarity 0.46
The niche, labels, vibe code rating and competitor comparison on this page are analysis by Nicheloom. If you use them, please credit nicheloom.com. How you may use our data.