Spider Analyzer and the eBPF visibility tools

Five tools let you see traffic between services without changing application code. They are not interchangeable, and the differences are not the ones a feature grid shows. Each was built to answer a different question, so the quickest way to choose is to work out which question is yours.

Start with the question you have

Who talks to whom, and what got dropped?

Hubble is the observability layer of Cilium, and if your cluster already runs Cilium it is the obvious first answer. It draws the best service map in this group, it understands Kubernetes identity rather than IP addresses, and its DNS visibility is the strongest in this group. Layer 7 detail is opt-in per workload and stays at the metadata level: you learn that a request happened and how it ended, not what it contained. It needs Cilium as your CNI, which is a decision about your cluster rather than about your tooling.

What is my application doing, and why is it slow?

Pixie is a developer's debugger. It traces syscalls with eBPF, hooks TLS libraries to read encrypted traffic, decodes a wider range of protocols than anything else here, and adds continuous CPU profiling and scriptable analysis. Data lives in memory on each node for roughly a day, which is a deliberate trade: Pixie is a live view of what is happening now, not a record of what happened before.

Can I get one correlated model of the whole system?

DeepFlow, from Yunshan Networks, is the broadest platform on this page: metrics, request logs, profiling, and AutoTracing, which reconstructs a request chain across services from eBPF alone with no trace context in the application. It stores to ClickHouse, so unlike Pixie it retains. If you want one system that replaces several, it is the most complete answer here.

What is happening in my cluster right now?

Kubeshark is the closest tool to Spider in this group. It captures cluster-wide, decrypts TLS without keys, exports filtered PCAP for Wireshark, and gives you a filter language that spans Kubernetes and network semantics at once. It is Apache-2.0 and free on small clusters. Its model is the point-in-time snapshot, which is excellent for watching what is happening and less suited to asking about last week.

What exactly crossed the wire, and can I replay it next week?

Spider Analyzer captures packets, rebuilds TCP sessions from them, and decodes HTTP, gRPC, PostgreSQL, Redis and Kafka request by request into an indexed record with full payloads, kept for as long as you choose. Kubeshark captures packets too. What Spider adds is keeping them, indexed and searchable alongside the decoded requests, which is what makes an investigation possible after the fact rather than only while it is happening.

What actually separates them

Capture depth

There are three ways to get the data. Hubble reads flow records from the datapath. Pixie and DeepFlow trace syscalls and hook TLS libraries. Spider captures the packets themselves and works upward from them. Kubeshark does two of the three: it captures packets like Spider and hooks TLS libraries like the others, but the two remain separate views rather than one.

The TLS difference is worth understanding, because it is not obvious from a feature list. Kubeshark, Pixie and DeepFlow all obtain plaintext by attaching probes to the TLS library and taking the buffer after decryption on read and before encryption on write. Spider attaches probes to the same functions but takes the session key instead, and uses it to decrypt the packets it captured off the wire.

The payload comes out the same. The evidence does not. A handshake that fails produces no application data, so a plaintext probe captures nothing at the exact moment you most need to look, while Spider still holds the packets, the cipher suites, the certificate and the alert. The same goes for everything the transport did underneath: retransmissions, reordering, loss, resets. A plaintext probe shows what the application meant to send, not what the network carried. How TLS decryption actually works →

The trade runs both ways, and it is worth being straight about it. Hooking plaintext is cheaper, needs no packet storage, and never fails because a key was missed. Spider spends more to keep the evidence.

Memory

How far back can you ask? Pixie keeps roughly a day, in memory on each node. Hubble keeps a ring buffer of recent flows unless you export them, with longer history a commercial add-on. Kubeshark keeps whatever you snapshotted at the time. DeepFlow and Spider both retain properly, on ClickHouse and Elasticsearch respectively.

What is retained differs even there. DeepFlow keeps metrics and request logs. Spider keeps the requests themselves, bodies included, with the packets that carried them still behind each one. At Flowbird, now Arrive, that runs at over a terabyte a day on a one-week rolling window, and the architecture is built to go further. What a retained record makes possible →

Reach

Hubble, Pixie and Kubeshark all stop at the Kubernetes boundary. Spider's capture agents ship as binaries and Docker images and run on anything with a Linux kernel, whether that is a pod, a virtual machine or a physical server, so a hybrid estate stays one system instead of two. DeepFlow also covers hosts and cloud VMs. Kubernetes is where Spider's backend runs, not a limit on where Spider can see. Packet capture works on any Linux kernel; the TLS key agent needs 5.6 or later, because that is where eBPF uprobes arrived.

On open source and cost

Hubble, Pixie, DeepFlow and the core of Kubeshark are all Apache-2.0. You can run them at any scale without paying anyone, and for plenty of teams that settles it. If you need a service graph on a cluster already running Cilium, install Hubble. If you want to poke at a slow endpoint this afternoon, install Pixie. Neither of those is a decision we are trying to talk you out of.

Spider is commercial software, and what a licence buys is fairly specific: a decoder for a protocol nobody else is going to write, which is as much a service as a feature; someone on an SLA when the thing you are investigating is on fire; training for the people who have to operate it; and a retained, indexed record rather than a live view. The free BASIC tier is self-hosted like every other tier. What each tier includes is on the pricing page.

When not to choose Spider

• You already run Cilium and what you want is the service graph. Hubble is right there, and it is excellent.
• You want continuous profiling. Spider does not do it and is not planning to. Pixie and DeepFlow both do.
• Your policy is a fully open-source stack. Spider is commercial, and that is not negotiable.
• You want one platform covering metrics, traces, logs and profiling. That is DeepFlow's design goal, not Spider's.
• You need to look at traffic for twenty minutes and never again. Kubeshark installs in one command and is free at that size.

Where to go next

• Decrypting TLS in Kubernetes without private keys
• Capturing and replaying traffic between services
• Reconstructing what happened on the wire last week
• Real incidents Spider diagnosed in production

Competitor details checked on 9 August 2026 against vendor documentation. Support in this field changes quickly and varies by protocol, kernel, deployment mode and edition. Verify against the current release before making a decision.