Heron
Wireshark for AI Agents: passive eBPF observability
121 followers
Wireshark for AI Agents: passive eBPF observability
121 followers
Heron is a passive network analyzer that reconstructs what your AI agents are actually doing. Zero SDKs. Zero proxy. Hook eBPF to see TLS-encrypted LLM calls and identify which agent process made them.
What's the performance impact of running Heron alongside a live agent in production?
Heron
@pradyumna6 Great question. Heron is designed to avoid request-path impact: it does not sit between your agent and the model provider, and it does not proxy or mutate requests. It passively observes traffic, so it should not add latency to the live agent path.
That said, it is still a real observer process, so the impact depends on traffic volume, body sizes, capture mode, retention settings, and storage backend. In production we recommend starting with a passive/shadow deployment, tuning retention and body caps, and watching CPU, memory, and disk I/O before expanding coverage.
The main design goal is: if Heron is slow or fails, your agent traffic should keep flowing. Heron may lose observability data under resource pressure, but it should not block the agent itself.
Heron
@pradyumna6 Minimum, in real production environment, we record almost 0% cpu usage in 8xB300 production nodes while heron is working very well.
eBPF for agent observability is such a smart call. Going passive means I don't have to wrap or instrument anything, which is honestly the part that always scares me about adding monitoring to a live product.
Heron
@yibo_wang3 Yes — this is basically the Heron thesis. Agent observability shouldn’t require every team to rewrite their stack or trust framework-level logs. A passive eBPF layer can observe real behavior from below: outbound calls, process activity, file access, tool/API patterns. That gives teams a safer way to add governance and debugging to live agent systems without putting instrumentation in the critical path.
eBPF for agent observability is such a smart call. Going passive means I don't have to wrap or instrument anything, which is honestly the part that always scares me about adding monitoring to a live product.