Skip to main content

grpcsnoop

tcpdump for gRPC. Watch the protobuf messages flowing between services, decoded to readable fields.

grpcsnoop turns the plaintext gRPC/protobuf flowing between containers into a live, decoded feed in your terminal. No proxy, no code changes — it hooks the TC layer on the container's veth, reads plaintext payloads with bpf_skb_load_bytes, reassembles TCP, and unwinds all three layers.

grpcsnoop demo

Running​

yeet run github:yeet-src/grpcsnoop -- --port 50051

Try it against the bundled demo (two containers on a Docker bridge, talking plaintext gRPC):

git clone https://github.com/yeet-src/grpcsnoop && cd grpcsnoop
bash demo/up.sh
yeet run . --port 50051
bash demo/down.sh

Source​

yeet-src/grpcsnoop on GitHub.