Spider Analyzer The owner has verified their profile information displayed on this page.

Questions and answers

• How does capture work when TLS traffic uses a library or runtime outside OpenSSL, Go, Java, and Rust?

  Asked by SaaS Browser · November 2, 2026

  Answered by Thibaut Raballand from Spider Analyzer · November 2, 2026

  Hi

  Capture always work as we're capturing packets with libpcap or af_packet.

  TLS decryption though requires a managed library to work.

  We can study the library you're using to see how we can get keys from it, or you can use a fallback, by sending Keylog to /dev/null. So that Spider can grab the keys on the fly.
  This is often an option available in the library you're using.

  Search "TLS key log fallback" in Spider blog or technical documentation for more details.
  I can't link the URL here :-(

  This is running in Demo cluster with a Rust based service.

  Thibaut

• Live service map
  See which workloads talk to each other, with volumes, latency and error rates.
• Multi-protocol parsing
  HTTP/1.1, HTTP/2, HTTP/3, gRPC, GraphQL, WebSocket, SSE, PostgreSQL, MySQL, Redis, Kafka, MQTT and DNS.
• CLI, API and MCP server
  Script queries with the spider CLI or REST API, or let AI assistants (Claude, etc.) query traffic through MCP.
• Capture import and export
  Upload pcap, pcapng or JSON captures to analyse traffic recorded elsewhere. Export in JSON, Excel, CSV and OTel.
• Agentless Kubernetes capture
  Attaches to any pod on demand as an ephemeral container. No sidecar, no redeploy and no code changes.
• Powerful search and analytics
  Lucene queries, aggregations, statistics and outlier detection across all captured traffic.
• TLS decryption without certificates
  Gocipher uses eBPF to collect TLS session keys from OpenSSL, Go, Java and Rust processes, so encrypted traffic is decoded automatically
• Full request and response inspection
  Headers, bodies, timings and status of every call, with sensitive fields redacted.
• Teams, sharing and retention policies
  Multi-team access control, SSO, shareable links, and configurable retention tiers.
• Drill-down to packets and TCP sessions
  Go from an API call down to the raw TCP session and packets for low-level debugging.

• Fast onboarding
  Understand an unfamiliar system in minutes from its real traffic map.
• Flexible deployment
  SaaS or self-hosted, with data kept in your own cluster when needed.
• Zero instrumentation
  No SDK, no logging changes and no redeploys. Works on legacy and third-party services as-is.
• Faster root cause analysis
  Cut incident resolution from hours to minutes by seeing what actually happened on the wire.
• Complements logs and traces
  Shows the payloads and calls that logs and APM miss, including databases and message brokers.
• Visibility into encrypted traffic
  Decode TLS traffic without managing certificates or proxies.

• Backend developers
  Debug integrations and API contracts by seeing the exact requests and responses exchanged.
• QA / test engineers
  Check that tests produce the expected calls, and build replay tests from real traffic.
• Software architects
  Discover and document real service dependencies and communication patterns.
• SRE / DevOps engineers
  Troubleshoot production incidents and latency issues across microservices.
• Security and compliance teams
  Audit API usage, spot unusual access patterns and authentication failures.