shawk
Shawk is a socket-based tracing infrastructure for discovering network dependencies among processes in distributed applications. It monitors network sockets, which serve as endpoints of TCP connections, to trace how services and processes interact across hosts. Tracer agents running on each host capture connection and process information from the Linux kernel and send it to a central Connection Management DataBase (CMDB), typically PostgreSQL 10 or later, where a dependency graph can be constructed. Shawk supports two probe modes. Polling mode periodically queries the kernel for snapshots of active TCP connections and their associated processes, with minimal impact on application network latency since it only reads connection metadata. Streaming mode uses eBPF for real-time connection tracking. Both modes can be configured via environment variables for probe interval, flush interval, and the CMDB database URL. A single-shot scan mode is also available. The look command queries the CMDB to display dependency i