skydive
Skydive is an open-source real-time network topology and packet analyzer written in Go. It collects flow data and network topology from distributed agents, centralizes it in Elasticsearch, and provides web/CLI interfaces and REST APIs for querying and visualization. It supports containers, VMs, and integrates with SDN platforms like OpenStack and Kubernetes.
Key facts
Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.
| Field | Value |
|---|---|
| Repository | skydive-project/skydive |
| Owner | skydive-project |
| Primary language | Go |
| License | Apache-2.0 — OSI-approved |
| Stars | 2.8k |
| Forks | 414 |
| Open issues | 119 |
| Latest release | v0.28.0 (2021-08-17) |
| Last updated | 2025-09-19 |
| Source | https://github.com/skydive-project/skydive |
What skydive is
Skydive uses eBPF-based packet capture and flow analysis, with a distributed agent-analyzer architecture backed by Elasticsearch for persistent storage and history. It exposes topology and flows via a Gremlin query language, supports multi-infrastructure environments (Docker, Kubernetes, OpenStack), and provides both programmatic (REST/Python client) and interactive (web UI, CLI) interfaces.
Get the skydive source
Clone the repository and explore it locally.
git clone https://github.com/skydive-project/skydive.gitcd skydive# follow the project's README for install & configurationNeed it deployed, integrated, or customized instead? DEV.co ships production installs.
Best use cases
Implementation considerations
- Requires root or privileged container access for packet capture and eBPF programs; plan RBAC and network policies accordingly in Kubernetes deployments.
- Elasticsearch backend is mandatory for history; plan storage sizing, retention policies, and cluster resilience as data volume grows with agent count and traffic diversity.
- Agent-to-analyzer communication is unencrypted by default; review network segmentation, TLS configuration options, and inter-pod communication policies in multi-tenant or sensitive environments.
- Gremlin query language has a learning curve; team familiarity with graph traversal queries affects time-to-value for custom topology and flow analysis.
- Latest stable release (v0.28.0) is from August 2021; evaluate whether pending fixes or feature gaps between then and September 2025 commits affect your use case.
When to avoid it — and what to weigh
- High-volume packet capture with low latency requirements — Skydive centralizes data in Elasticsearch, introducing network and processing overhead. For ultra-low-latency, in-line packet filtering, or very high-throughput packet processing, specialized tools may be more appropriate.
- Minimal operational overhead desired — Deployment requires coordinating multiple components (agents, analyzer, Elasticsearch), persistent storage, and monitoring. Single-point network analysis tools require less infrastructure.
- Enterprise support and SLA guarantees required — Latest release was August 2021; last commit September 2025. While the project is not archived, support model is community-driven. Organizations needing guaranteed response times should verify vendor support availability.
- Proprietary or air-gapped environments with strict kernel/eBPF policies — Skydive relies on eBPF for flow capture. Environments with locked-down kernel policies, SELinux restrictions, or where eBPF is disabled will face limitations or require custom configuration.
License & commercial use
Apache License 2.0, a permissive OSI-approved license permitting commercial use, modification, and distribution under the same license terms.
Apache 2.0 explicitly permits commercial use. No viral copyleft; you may use, modify, and distribute Skydive in proprietary products, provided you include the license and attribute the original work. No warranty is provided; review your liability and indemnification policies accordingly.
DEV.co evaluation signals
Editorial assessment — not user reviews. Directional, with an explicit confidence level.
| Signal | Assessment |
|---|---|
| Maintenance | Moderate |
| Documentation | Adequate |
| License clarity | Clear |
| Deployment complexity | Moderate |
| DEV.co fit | Good |
| Assessment confidence | Medium |
Skydive captures live network traffic and requires root/privileged access; ensure network isolation and RBAC controls. eBPF programs run in kernel space; validate compatibility with kernel versions and security modules (SELinux, AppArmor). Agent-to-analyzer communication is unencrypted by default; configure TLS if data transits untrusted networks. No disclosure of known vulnerabilities in provided data; review CVE databases and security audits independently. Elasticsearch backend should be protected with authentication and network segmentation.
Alternatives to consider
Wireshark / tshark
Single-point, high-fidelity packet analysis without distributed agents or persistent storage. Better for ad-hoc packet inspection; lacks real-time topology visualization and historical queries.
Cilium Hubble
Kubernetes-native eBPF-based network observability tightly integrated with Cilium; easier for K8s-only environments, but less multi-infrastructure support and fewer SDN integrations than Skydive.
Zeek (formerly Bro) + ELK stack
Deep protocol analysis with Elasticsearch backend; strong on traffic classification and threat detection. Steeper learning curve; manual engineering required vs. Skydive's integrated agent model.
Build on skydive with DEV.co software developers
Skydive provides real-time topology and flow analysis across distributed infrastructure. Ready to assess fit? Review the full evaluation above, test a Helm or Docker deployment, and verify compatibility with your SDN and storage platforms. Contact our team to discuss integration strategy.
Talk to DEV.coRelated open-source tools
Surfaced by semantic similarity across the DEV.co open-source index.
Related on DEV.co
Explore the category and the services that help you build with it.
skydive FAQ
Does Skydive require changes to my network infrastructure?
Can Skydive run without Elasticsearch?
What is the performance impact of Skydive agents?
Is Skydive suitable for enterprise production?
Software developers & web developers for hire
Need help beyond evaluating skydive? DEV.co is a software development agency offering software development services and web development for teams of every size. Our software developers and web developers build custom software, web applications, APIs, and open-source observability integrations — and maintain them long-term.
Evaluate Skydive for Your Network Monitoring Stack
Skydive provides real-time topology and flow analysis across distributed infrastructure. Ready to assess fit? Review the full evaluation above, test a Helm or Docker deployment, and verify compatibility with your SDN and storage platforms. Contact our team to discuss integration strategy.