{
  "id": 8546464,
  "title": "See every API your server calls (and every call it receives) without changing a line of code",
  "url": "https://urgent.news/2026/09/19/see-every-api-your-server-calls-and-every-call-it-receives-without",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-19T21:45:20.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ritompuzari/see-every-api-your-server-calls-and-every-call-it-receives-without-changing-a-line-of-code-39fh"
  },
  "original_language": "en",
  "account": "Capturing every API call a server makes or receives without modifying any code can be achieved by listening to the server's network interface. By installing a raw socket using `socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL))` on Linux, you can capture every frame that crosses the interface. To optimize performance, a BPF (Berkeley Packet Filter) program is attached with `setsockopt(SO_ATTACH_FILTER)`, which filters out all frames except those with TCP as the next header. This leaves a stream of TCP segments, from which useful data can be extracted.\n\nThe request and response lines of HTTP/1.x requests and responses, along with the TLS ClientHello of fresh connections, contain the essential information needed for analysis. By keying data by the 4-tuple (source address, source port, destination address, destination port) and pairing each request with its corresponding response, you can calculate latency for each request. This data allows you to determine key metrics such as counts, 4xx/5xx error rates, and p50/p95/max latency per endpoint.\n\nThe process also allows for the reconstruction of a service map, showing which hosts are being depended on, how often, and how slowly. This is done by normalizing request targets, which proxies use, to a path format. While encrypted ClientHello traffic hides SNI, it still reveals the host being accessed and other relevant details. Additionally, for local services, the agent provides full request-level data for internal applications, even when accessed over TLS.\n\nThere are some limitations to this approach, such as the inability to parse HTTP/2 and gRPC traffic without specialized logging or SDKs. However, these can be addressed by using the reverse proxy's access logs or an in-process SDK. The agent also has two main constraints: parsing only if the request line and Host header are within the first 2 KB of the first segment, and attributing keep-alive requests by order. Despite these limitations, the overall process provides valuable insights into server performance and dependencies without requiring any code changes, using only standard Linux tools and a lightweight Python agent.",
  "summary": "Instrumenting an application for APM means picking a vendor SDK, adding it to every service, redeploying, and hoping the framework version is supported. There is an older trick that gets you most of the value with none of that: listen to the network interface. What the host can see A raw socket opened with socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)) on Linux receives a copy of every frame that…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}