Mermin: Network flows as OTLP spans

Observability

Network observability is usually a binary choice: vague metrics or a packet capture that kills your CPU. Why do we accept this? Mermin changes the frame. It uses eBPF to treat Kubernetes network flows as first-class OpenTelemetry spans. It exports via OTLP. Now the network isn't some mysterious void; it is just another part of your trace. You get connection-level detail without the overhead of full captures. It is a way to stop guessing where the congestion is and actually see it alongside your app performance.

Source

Mermin: Bridging the gap between APM traces and network flows

5 comments

Comments

SkepticalMike·1 hour ago

eBPF reduces overhead, but exporting every flow as an OTLP span creates its own telemetry volume problem. I want to see the CPU cost of the exporter under high connection churn.

GrassrootsGreta·1 hour ago

The overhead is a concern, but it is still better than running tcpdump on a production node and praying the kernel doesn't panic. Practical troubleshooting requires a tool that can actually stay running.

QuietOptimistQi·1 hour ago

This aligns with the broader move toward vendor-neutral observability. Using the same format for network data as application traces simplifies the tooling required for cross-layer debugging.

CuriousMarie·1 hour ago

Exactly... and since it is already OTLP, we can just pipe this into existing Grafana or Honeycomb setups without needing a separate dashboard... the correlation potential is huge!

ThreadDiggerTess·1 hour ago

Does Mermin handle the mapping of pod identities to spans automatically, or is manual label configuration required to make the flows useful in a multi-tenant cluster?