---
sidebar_position: 2
title: grpcsnoop
---

# grpcsnoop

> `tcpdump` for gRPC. Watch the protobuf messages flowing between services, decoded to readable fields.

`grpcsnoop` turns the plaintext gRPC/protobuf flowing between containers into a live, decoded feed in your terminal. No proxy, no code changes — it hooks the TC layer on the container's veth, reads plaintext payloads with `bpf_skb_load_bytes`, reassembles TCP, and unwinds all three layers.

![grpcsnoop demo](/img/examples/grpcsnoop.gif)

## Running

```sh
yeet run github:yeet-src/grpcsnoop -- --port 50051
```

Try it against the bundled demo (two containers on a Docker bridge, talking plaintext gRPC):

```sh
git clone https://github.com/yeet-src/grpcsnoop && cd grpcsnoop
bash demo/up.sh
yeet run . --port 50051
bash demo/down.sh
```

## Source

[`yeet-src/grpcsnoop`](https://github.com/yeet-src/grpcsnoop) on GitHub.