Nine BPF instructions move HTTP instrumentation from the deploy pipeline to the host

What you get depends on what your services speak. Plain HTTP/1.x yields method, path with the query string stripped, `Host`, status code, bytes each way, and the time from the request segment to the first byte of the response ^[6]. The post says that is enough for per-endpoint counts, 4xx and 5xx rates and p50/p95/max ^[6]. HTTP/2 multiplexes streams inside one connection and is almost always inside TLS, so without keys it shows up as an opaque flow with byte counts; gRPC is the same, and cleartext `h2c` is binary-framed, so the request-line parser skips it too ^[12]. Group the traffic cases the post enumerates and two give request-level detail, one gives host-level metadata from SNI, and three give byte counts or nothing ^[23].

The post says traffic between a reverse proxy and the app on `127.0.0.1:8000` is usually plain HTTP, so the tap gets full request-level detail for your own application even when the public side is TLS ^[11]. Outbound calls have to be TLS 1.2 or 1.3, where the ClientHello carries Server Name Indication in the clear ^[8]. Encrypted ClientHello hides SNI, though the post says adoption on API endpoints is still rare ^[10]. Among what the outgoing map turns up, the post lists "a third-party API nobody knew about" ^[9].

Two parser decisions are better than they had to be. Keep-alive connections that pipeline requests are attributed by order, and the post notes that is correct for HTTP/1.1 because responses must arrive in request order ^[15]. Absolute-form request targets, the kind proxies send, are normalised to a path ^[7]. The limit sits in the first segment: a request is only parsed if the request line and the `Host` header are within its first 2 KB ^[14]. Large headers on a long URL can push `Host` past that window, and the post does not say whether the agent counts what it failed to parse.

The SDK path costs a redeploy of every service and a bet that your framework version is supported ^[22]. The tap costs root. Installed as root it enables capture automatically; without root it still reports metrics, processes and connections from `/proc/net/tcp`, but no per-request detail ^[21]. That will be either the shortest install of your year or the longest conversation with your security reviewer. This is the right trade for a fleet of HTTP/1.1 services behind nginx; for a gRPC mesh it is not, because the tap counts bytes and the request detail has to come from the proxy access log or an in-process SDK ^[12][13].

The agent keeps a small sample of the slowest and failing requests with their timing ^[18]. Each destination's reverse-DNS name is resolved once and cached, so the outgoing map shows `api.stripe.com` instead of an IP ^[19].