See every API your server calls (and every call it receives) without changing a line of code

Capturing every API call a server makes or receives without modifying any code can be achieved by listening to the server's network interface. By installing a raw socket using `socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL))` on Linux, you can capture every frame that crosses the interface. To optimize performance, a BPF (Berkeley Packet Filter) program is attached with `setsockopt(SO_ATTACH_FILTER)`, which filters out all frames except those with TCP as the next header. This leaves a stream of TCP segments, from which useful data can be extracted.

The request and response lines of HTTP/1.x requests and responses, along with the TLS ClientHello of fresh connections, contain the essential information needed for analysis. By keying data by the 4-tuple (source address, source port, destination address, destination port) and pairing each request with its corresponding response, you can calculate latency for each request. This data allows you to determine key metrics such as counts, 4xx/5xx error rates, and p50/p95/max latency per endpoint.

The process also allows for the reconstruction of a service map, showing which hosts are being depended on, how often, and how slowly. This is done by normalizing request targets, which proxies use, to a path format. While encrypted ClientHello traffic hides SNI, it still reveals the host being accessed and other relevant details. Additionally, for local services, the agent provides full request-level data for internal applications, even when accessed over TLS.

There are some limitations to this approach, such as the inability to parse HTTP/2 and gRPC traffic without specialized logging or SDKs. However, these can be addressed by using the reverse proxy's access logs or an in-process SDK. The agent also has two main constraints: parsing only if the request line and Host header are within the first 2 KB of the first segment, and attributing keep-alive requests by order.

Despite these limitations, the overall process provides valuable insights into server performance and dependencies without requiring any code changes, using only standard Linux tools and a lightweight Python agent.