httpinspect
top, but for the HTTP endpoints on your host — a live dashboard of the most active plaintext HTTP endpoints, right in the terminal.
What is it?
What it is
A real-time terminal dashboard for monitoring plaintext HTTP traffic on a host using eBPF
Why it exists
To provide ground-truth observability of HTTP endpoints without proxies, sidecars, or app changes
Who should use it
Developers, DevOps, observability engineers, and system administrators who want real‑time insight into plaintext HTTP traffic on a Linux host without deploying proxies or sidecars.
Who should avoid it
Users on non‑Linux systems, those who need to monitor HTTPS traffic, or teams that cannot run privileged eBPF programs or accept a terminal‑based UI.
How it works
A quick walkthrough in plain English
How httpinspect works
Step 1 of 3
You interact with it
Open httpinspect, send a request, or connect it to your stack.
Features
Advantages
- Open source (Open Source)
- Active JavaScript ecosystem
- Self-hosted deployment options
Disadvantages
- Requires operational ownership for self-hosted setups
- Community support varies by project maturity
Installation
native
curl -fsSL https://yeet.cx | sh\nmake
FAQ
How do I install and run httpinspect on my Linux host?
Run the one‑liner `curl -fsSL https://yeet.cx | sh` to install the yeet daemon, then build the project with `make`. Finally start the dashboard with `yeet run .` (or `yeet run . -- --iface lo,eth0` to limit interfaces). The tool will attach to all up interfaces by default and display a live top‑style table of plaintext HTTP traffic.
What traffic does httpinspect observe and what is it missing?
httpinspect reads the first bytes of TCP payloads at the TC layer. It captures only plaintext HTTP requests and responses, so HTTPS traffic (encrypted payloads) is invisible. It also ignores non‑HTTP traffic and only parses the first 512 bytes of each request, which is enough for the request line and Host header.
How can I customize which interfaces to watch or keep query strings separate?
Use flags after the `--` separator. For example, `yeet run . -- --iface lo,eth0` watches only loopback and eth0, and `yeet run . -- --keep-query` keeps query strings distinct so `/x?id=1` and `/x?id=2` appear as separate rows.
Why does httpinspect not require a proxy or sidecar?
It attaches eBPF programs to the kernel’s TC layer, which observes packets as they flow through the network stack. This means it can capture requests without redirecting traffic or modifying application configuration, and it also sees loopback traffic between local services.
How does httpinspect calculate latency for each endpoint?
Each response is paired with the oldest unmatched request on the same TCP flow (based on the 4‑tuple). The timestamp difference between the request and its response, as seen at the TC layer, gives the on‑the‑wire latency, which includes network RTT. Latency statistics (p50, p95, max) are aggregated per endpoint.
Featured in Videos
YouTube tutorials and walkthroughs for httpinspect
Alternatives
Similar projects ranked by category, topics, and text overlap.
