Mermin is a powerful, Kubernetes-native network observability tool that uses eBPF to efficiently capture network traffic and export it as Flow Traces via the OpenTelemetry Protocol (OTLP). It provides deep visibility into your cluster's network communications with zero application changes required.
Your APM traces show application behavior. Your network monitoring shows IP-level statistics. But there's a gap: when a trace shows a slow network span, you have no way to correlate that with actual network flow data. When network teams see congestion, they can't map it back to specific services or pods.
The MELT stack (Metrics, Events, Logs, Traces) is missing network flow data—connection-level information that bridges application performance with network reality.
Mermin captures network traffic using eBPF and exports it as Flow Traces—network flows represented as OpenTelemetry spans. This brings network visibility into the OTel ecosystem using a standard signal type.
The "Sweet Spot": Why Flow Data?
Observability involves trade-offs between granularity and overhead. Flow data sits between two extremes:
- Not Raw PCAP: Full packet capture is expensive to store and query. Mermin aggregates packets into flows—you get connection-level detail without payload overhead.
- Not Just Counters: Metrics tell you bandwidth usage but miss connection context—timing, retransmissions, directionality.
Flow data provides granular, connection-level detail that's lightweight enough to run always-on in production.
- Auto-Instrumentation for Your Network Stack: Just as eBPF-based APM tools auto-instrument application code, Mermin auto-instruments your network layer. Deploy once per node, get visibility into all traffic—no per-service configuration required.
- Kubernetes-Native Enrichment: Flows include Pod, Service, and Deployment metadata. You see
frontend-service→redis-cache, not10.42.0.5→10.42.0.8. - Zero Code Changes: eBPF captures traffic transparently—no sidecars, no application modifications, no service mesh required.
- Standards-Based Export: Native OTLP output integrates with your existing observability stack (Tempo, Jaeger, Elastic, etc.).
- Production-Ready: Low-overhead kernel-level capture designed for always-on operation.
The fastest way to get started with Mermin is to deploy it to a local Kubernetes cluster using our quickstart guide:
Follow the Complete Quickstart Guide
Or deploy directly with Helm:
helm repo add elastiflow https://elastiflow.github.io/mermin
helm install mermin elastiflow/mermin --namespace mermin --create-namespaceOnce deployed, Mermin runs as a DaemonSet with one pod per node, automatically capturing network traffic and exporting Flow Traces to your configured OTLP endpoint.
| Feature | Mermin | eBPF APM Agents | Traditional NetFlow/IPFIX | Service Mesh (Istio/Linkerd) | Packet Capture Tools |
|---|---|---|---|---|---|
| Kubernetes Context | ✅ Native | ✅ Native | ❌ None | ✅ Native | ❌ None |
| Application Changes | ✅ Zero | ✅ Zero | ✅ Zero | ❌ Sidecar injection | ✅ Zero |
| Network Data Type | ✅ Flow Records | ❌ Counters only | ✅ Flow Records | ✅ Full packets | |
| Connection Context | ✅ Full details | ❌ Aggregated metrics | ✅ Full details | ✅ Full packets | |
| Performance Overhead | ✅ Minimal (eBPF) | ✅ Minimal (eBPF) | ✅ Low | ❌ High (full capture) | |
| Standards-Based Export | ✅ OTLP Traces | ❌ PCAP files | |||
| Bidirectional Flows | ✅ Yes | ❌ Separate counters | ✅ Yes | ❌ Packet-level only | |
| Deployment Complexity | ✅ Simple DaemonSet | ✅ Simple DaemonSet | ✅ Simple | ✅ Simple |
Key Differentiators:
- vs eBPF APM Agents: Exports flow records (with timing, flags, directionality) as traces, not aggregated counter metrics
- vs NetFlow/IPFIX: Adds Kubernetes context and uses modern OTLP standard
- vs Service Meshes: No application changes, lower overhead, but L3/L4 only (not L7)
- vs Packet Capture: Aggregated flows instead of raw packets, with metadata enrichment
Mermin operates as a DaemonSet in Kubernetes (or as a privileged container on bare metal), with one instance running on each node:
- Packet Capture: eBPF programs attached to network interfaces capture packets at the kernel level.
- Flow Aggregation: Packets are aggregated into bidirectional network flows with connection state tracking.
- Metadata Enrichment: Flows are decorated with Kubernetes metadata (pods, services, deployments, labels).
- Flow Traces Export: Flows are converted to OpenTelemetry trace spans and exported via OTLP
- Observability Backend: Flow Traces are stored, analyzed, and visualized in your platform (Elastic, Grafana Tempo, Jaeger, etc.)
For a deeper dive into Mermin's architecture, see our Architecture Overview.
Comprehensive documentation is available in the docs/ directory:
- Quickstart Guide - Get up and running in minutes
- Architecture Overview - Understand how Mermin works
- Deployment Guide - Deployment strategies and best practices
- Kubernetes with Helm - Kubernetes deployment details
- Cloud Platforms - AWS, GCP, Azure specifics
- Docker & Bare Metal - Non-Kubernetes deployments
- Configuration Reference - Complete configuration options
- OTLP Export - Configure OpenTelemetry export
- Filtering - Control which flows are captured
- Kubernetes Metadata - Kubernetes integration options
- Supported Backends - Elastic, Grafana, Tempo, Jaeger, and more
- Troubleshooting Guide - Common issues and solutions
- Deployment Issues - Pod startup and configuration problems
- Interface Visibility - Traffic capture and CNI configuration
- Common eBPF Errors - Verifier failures and kernel compatibility
- Contributing Guide - How to contribute to Mermin
- Development Workflow - Build, test, and contribute
- Debugging eBPF Programs - eBPF debugging techniques
- Debugging Network Traffic - Wireshark and packet analysis
We welcome contributions from the community! Whether you're fixing bugs, adding features, improving documentation, or sharing feedback, your contributions help make Mermin better for everyone.
- 🐛 Report bugs via GitHub Issues.
- 💡 Request features or share ideas in GitHub Discussions.
- 📝 Improve documentation - PRs for doc improvements are always welcome.
- 🔧 Submit code - See our Development Workflow to get started.
- 💬 Help others - Answer questions in Discussions or Slack.
- Read the Development Workflow - Learn how to build, test, and develop Mermin.
- Check out Good First Issues - Find beginner-friendly tasks.
- Join the conversation - Connect with us on Slack or GitHub Discussions.
All contributors are expected to follow our code of conduct and maintain a welcoming, inclusive environment.
Get Help:
- 💬 Slack Channel - Live chat with maintainers and community.
- 💭 GitHub Discussions - Ask questions and share knowledge.
- 🐛 GitHub Issues - Report bugs and track feature requests.
- 📖 Documentation - Comprehensive guides and references.
- ⭐ Star the repo on GitHub to stay notified of new releases.
- 📢 Follow us for announcements and updates.
- 🔔 Watch the repository for issue and discussion notifications.
- For commercial support, visit ElastiFlow.
Docker images are available in the GitHub Container Registry:
docker pull ghcr.io/elastiflow/mermin:latestdocker pull ghcr.io/elastiflow/mermin:latest-debugThe debug image is built using the gcr.io/distroless/cc-debian12:debug base image and provides additional debugging tools compared to the standard image.
With the exception of eBPF code, Mermin is distributed under the terms of the Apache License (version 2.0).
Any contribution intentionally submitted for inclusion in this crate by you, shall be licensed Apache-2.0, without any additional terms or conditions.
All eBPF code is distributed under the terms of the GNU General Public License, Version 2.
Any contribution intentionally submitted for inclusion in this project by you, shall be dual licensed GPL-2, without any additional terms or conditions.