中文 · English

What's New: Analyzer module fully rewritten in Go + cilium/ebpf, replacing the original Python + BCC implementation. Lightweight redesign removes BCC runtime dependency, uses CO-RE (bpf2go) for pre-compiled eBPF, and adds MCP skill integration for each module.

PacketScope is a general-purpose protocol stack analysis and debugging tool based on eBPF. It integrates performance optimization, anomaly diagnosis, and security defense. It aims to implement fine-grained tracing and intelligent analysis of network packets at the protocol stack level on the server side. By solving three major pain points—difficult diagnosis of performance bottlenecks, unclear transmission paths, and hard-to-detect low-level attacks—PacketScope provides visualized, intelligent endpoint-side security analysis and defense capabilities.

With the proliferation of social platforms, online banking, large-scale AI models, logistics, and travel services, open servers have become key execution environments. These must balance performance and security under the condition of being openly accessible. Traditional WAFs and IDS tools have blind spots in protocol stack-level defense, which PacketScope addresses:

🚨 Three Core Pain Points:

1. Unclear packet paths through the protocol stack make bottlenecks and faults hard to diagnose
2. Lack of fine-grained cross-domain transmission data makes routing risks invisible
3. Low-level protocol stack attacks are stealthy and difficult to detect with traditional tools

Through protocol tracing, path visualization, and intelligent analysis, PacketScope builds "smart armor" for the server.

• 🧠 Intelligent Engine: Combines eBPF with LLMs for low-level network behavior observation and intelligent security defense
• 📊 Multidimensional Analysis: Real-time tracking of network paths, statistics on latency, packet loss, interaction frequency
• 🌐 Global Network Visualization: Maps global paths and latency, presented on a topology graph
• 🔐 Protocol Stack Defense: Detects and intercepts low-level abnormal traffic, covering the blind spots of traditional WAF/IDS
• 🤖 MCP Skill Integration: Each module provides an MCP server for LLM agent integration (Trae, Cline, etc.)
• 🖥️ User-Friendly Interface: GUI designed for easy use by security engineers and operators

• Docker: Version 20.10 or higher
• Docker Compose: Version 2.0 or higher

docker --version
docker compose version

git clone https://github.com/Internet-Architecture-and-Security/PacketScope.git
cd PacketScope
sudo bash starter.sh

The script will automatically check Docker, build all containers in order, and start all services.

Open your browser: http://localhost:4173/

sudo docker compose ps              # View status
sudo docker compose logs -f         # View logs
sudo docker compose down            # Stop all
sudo docker compose restart <name>  # Restart a service

PacketScope/
├── modules/                    # Backend service modules
│   ├── Analyzer/              # Protocol stack analysis (Go)
│   │   ├── Monitor/           # Packet capture & function call monitor (Go + eBPF)
│   │   ├── Calculator/        # Cross-layer metrics calculator (Go + eBPF)
│   │   ├── README.md          # English docs
│   │   └── README-zh.md       # Chinese docs
│   ├── Guarder/               # Security defense (Go + eBPF/XDP)
│   └── Tracer/                # Route tracing & risk analysis (Python + MCP)
├── skills/                     # MCP skill packages for LLM agents
│   ├── monitor/               # Monitor MCP server & client
│   ├── tracer/                # Tracer MCP server & client
│   └── guarder/               # Guarder MCP client
├── src/                        # Frontend source (React + TypeScript)
├── docker-compose.yml          # Docker Compose configuration
├── starter.sh                  # One-click deployment script
├── README.md                   # This file
└── README-zh_CN.md             # Chinese docs

The Analyzer module has been fully rewritten in Go + cilium/ebpf, replacing the original Python + BCC implementation. This lightweight redesign removes BCC runtime dependency, uses CO-RE (bpf2go) for pre-compiled eBPF, and significantly improves deployment portability.

Monitor captures packets and tracks kernel function calls:

Calculator computes real-time cross-layer metrics:

Communication via WebSocket (port 8020), metrics pushed every second.

See Analyzer/README.md for details.

Maps network paths from the host to any global IP with geographic/ASN enrichment, anomaly detection, and Spamhaus-based risk scoring.

HTTP API on port 8000, MCP server for LLM agent integration.

See Tracer/README.md for details.

eBPF/XDP-based network security module with AI-powered filter generation.

HTTP API on port 8080, supports OpenAI-compatible and Anthropic-compatible endpoints.

See Guarder/README-zh.md for details.

Each backend module provides an MCP (Model Context Protocol) server, enabling LLM agents to directly invoke module capabilities:

{
  "mcpServers": {
    "packetscope-monitor": {
      "transport": "sse",
      "url": "http://localhost:8012/sse"
    },
    "packetscope-tracer": {
      "transport": "sse",
      "url": "http://localhost:8013/sse"
    }
  }
}

See skills/ for each skill's configuration and usage.

Lightweight redesign highlights (Analyzer → Go):

• Removed BCC runtime dependency — no Python, no BCC installation required
• Pre-compiled eBPF via bpf2go (CO-RE) — portable across kernel versions
• Single binary deployment — no external script dependencies
• Lower resource footprint — Go vs Python runtime overhead

• Network Protocol Stack Performance Optimization: Identify bottlenecks and improve transmission efficiency
• Threat Detection and Security Defense: Detect and block potential attacks such as DDoS and ARP spoofing
• Fault Diagnosis: Diagnose issues caused by latency, packet loss, or abnormal cross-layer behavior
• Topology Analysis: Analyze path latency and routing performance in cross-regional deployments
• Industrial Internet Security: Monitor industrial control systems in real time to ensure safety and integrity

We welcome issues and pull requests! If you find bugs or have suggestions, open an issue or PR. Please refer to CONTRIBUTING for contribution guidelines.

This project is licensed under the MIT License. See LICENSE for details.