Skydive is an open source, Apache-2.0 licensed, Go-based real-time network topology and protocols analyzer for network engineers, cloud and Kubernetes operators, and SREs who need a live, queryable picture of what their infrastructure is actually doing.

What it is

Skydive is a distributed network analyzer. Agents run on the hosts being observed, collect topology information and flows, and forward that data to a central analyzer agent for further analysis. All of the information is stored in an Elasticsearch database, which gives the deployment a full history of network topology and flows rather than only a live snapshot. Skydive is SDN-agnostic, but it ships SDN drivers that enrich the topology and flow information with details the underlying network controller already knows.

The concrete problem it solves is correlation. Network data usually lives in disconnected places: packet captures taken one host at a time, topology recorded in diagrams or configuration files, and flow records in yet another tool. Skydive puts topology and flows into one place, keeps their history, and lets a single query language reason over both. In the monitoring and observability ecosystem around Kubernetes, OpenStack, Docker, and OpenContrail, it fills the gap between host-local packet capture tooling and hand-maintained topology documentation, and it does so without requiring a particular SDN vendor.

Key capabilities

• Skydive agents capture network topology and flows and forward them to a central analyzer agent, which stores everything in Elasticsearch with a full history.
• Flows can be followed along a path in the topology, connecting an observed flow to the devices and links it traverses.
• A single query language, Gremlin, covers both topology and flows; the command line client runs queries such as g.V().
• Three interfaces are provided: a Web UI (default analyzer port 8082), a command line interface, and a REST API.
• Connectors exist for OpenStack, Docker, OpenContrail, and Kubernetes, and SDN drivers enhance the collected topology and flow detail.
• Virtual machine and container infrastructure is supported, and the project is tagged for eBPF, pcap, packet-analyzer, packet-sniffer, traffic-analysis, and traffic-monitoring use.
• Deployment options include a standalone executable with an allinone mode, the Docker image skydive/skydive, Helm charts under contrib/charts, and a contrib/docker/docker-compose.yml file.

Who uses it and how

• Kubernetes operators deploy skydive-analyzer and skydive-agent as Helm releases from the charts in the repository, then port-forward service port 8082 to reach the analyzer Web UI.
• Container host operators run skydive/skydive allinone with --privileged --pid=host --net=host, mounting /var/run/docker.sock and /run/netns so the agent can see container network namespaces.
• Cloud operators on OpenStack or OpenContrail rely on the SDN connectors to enrich the topology and flow information beyond what agents observe on their own.
• Teams that need history run the Docker Compose setup, which starts an Elasticsearch container together with an analyzer and an agent, rather than the stateless all-in-one mode.
• Automation and tooling teams query the REST API directly or use the Python client published as skydive-client on PyPI.

Getting started

The fastest path is the all-in-one binary: download skydive-latest.gz, decompress it, and run SKYDIVE_ETCD_DATA_DIR=/tmp SKYDIVE_ANALYZER_LISTEN=0.0.0.0:8082 sudo -E /usr/local/bin/skydive allinone, then open http://localhost:8082. Docker (docker run ... skydive/skydive allinone) and Helm from Git are documented as alternatives for Kubernetes.

How it compares

No comparable or paid products are named in the available facts, so Skydive stands alone in this registry on the evidence given.

When to use it — and when not to

A self-hoster must operate more than a single process: history requires an Elasticsearch database, the all-in-one mode uses an etcd data directory, and agents typically need privileged containers, host networking and PID, and access to /var/run/docker.sock and /run/netns. Anyone who cannot grant that level of host access, or who wants a managed service instead of running Elasticsearch, should look elsewhere. The project also shows a steady backlog of 119 open issues and its last push was September 2025, so users should confirm current release cadence before depending on it in production.

curl -Lo - https://github.com/skydive-project/skydive-binaries/raw/jenkins-builds/skydive-latest.gz | gzip -d > skydive && chmod +x skydive && sudo mv skydive /usr/local/bin/

SKYDIVE_ETCD_DATA_DIR=/tmp SKYDIVE_ANALYZER_LISTEN=0.0.0.0:8082 sudo -E /usr/local/bin/skydive allinone

helm plugin install https://github.com/aslafy-z/helm-git --version 0.10.0
helm repo add skydive git+https://github.com/skydive-project/skydive@contrib/charts
helm repo update
helm install skydive-analyzer skydive/skydive-analyzer
helm install skydive-agent skydive/skydive-agent
kubectl port-forward service/skydive-analyzer 8082:8082

docker run -d --privileged --pid=host --net=host -p 8082:8082 -p 8081:8081 \
    -e SKYDIVE_ANALYZER_LISTEN=0.0.0.0:8082 \
    -v /var/run/docker.sock:/var/run/docker.sock -v /run/netns:/var/run/netns \
    skydive/skydive allinone

curl -o docker-compose.yml https://raw.githubusercontent.com/skydive-project/skydive/master/contrib/docker/docker-compose.yml
docker-compose up

docker run --net=host -ti skydive/skydive client query "g.V()"