See Network Problems Before They Become Incidents

Netdata eBPF monitoring collects L4 network metrics including TCP/UDP bandwidth (sent/received), active connections (inbound/outbound), TCP retransmissions, connection states, and port/IP tracking - all at per-second granularity. Metrics are automatically broken down by application (via apps.plugin) and systemd service. Learn more about Metrics Management.

Netdata eBPF requires Linux kernel ≥4.11 (recommended ≥5.5 for CO-RE support), root privileges or CAP_BPF + CAP_PERFMON capabilities, and eBPF-enabled kernel configuration. The feature auto-detects kernel capabilities and gracefully falls back to traditional network monitoring methods when eBPF is unavailable. Resource usage is minimal: <5% CPU and 150-200MB RAM including eBPF collection.

Netdata eBPF runs on the host kernel and provides host-level network visibility. For container-specific metrics, Netdata combines eBPF with cgroups.plugin which provides container and VM resource accounting. This approach works with any container runtime (Docker, containerd, CRI-O). Note that eBPF.plugin itself operates at the kernel level and has limitations when running inside containers.

Cilium/Hubble provides L3-L7 network policy enforcement and flow visibility (CNI replacement), while Netdata provides L4 infrastructure observability with long-term retention. Netdata complements Cilium by adding historical time-series analysis, ML-based anomaly detection, and correlation with system metrics. Use Cilium for network policy, Netdata for continuous infrastructure-level monitoring.

No. Netdata eBPF focuses on L4 network metrics (TCP/UDP bandwidth, connections, retransmissions) integrated with infrastructure observability. For L7 protocol parsing, consider complementing Netdata with specialized tools like Pixie or Cilium/Hubble. Netdata’s strength is continuous infrastructure-level monitoring with unlimited retention and ML-powered insights - not application-layer protocol analysis.

Netdata eBPF monitoring is included in all pricing tiers with no additional charges. Open-source version is free with unlimited nodes. Netdata Cloud Business plan uses predictable per-node pricing with unlimited network metrics, connections, and data volume - no per-metric or per-connection fees. All network telemetry stays on-premises, eliminating cloud egress costs. See Pricing for details.

Netdata gracefully falls back to traditional network monitoring methods using /proc/net/ statistics, interface metrics, and cgroups network accounting. The dashboard remains unified - you still get network visibility, just without kernel-level granularity. Netdata auto-detects kernel capabilities (BTF, CO-RE, trampoline) and uses the optimal collection mode available, with clear indicators when eBPF is unavailable.

Netdata’s edge-native architecture processes network data locally with configurable connection tracking limits. Efficient hash tables with automatic cleanup prevent memory explosion. Multi-tier retention (per-second → per-minute → per-hour) maintains long-term visibility without storage explosion. Industry-leading compression (0.6 bytes/sample) enables years of network data in gigabytes. Learn about Tiered Retention.

No. eBPF is a Linux-only technology. Netdata provides comprehensive Windows monitoring through native performance counters, including network interface statistics, but kernel-level eBPF network monitoring requires Linux. For cross-platform infrastructure, Netdata provides unified dashboards combining Linux eBPF metrics with Windows native metrics. Explore Windows Monitoring.

Netdata trains 18 ML models per network metric (bandwidth, connections, retransmissions) using different time windows. Models detect anomalies through multi-model consensus, achieving 99% false positive reduction in anomaly detection. Anomaly Advisor automatically correlates network anomalies with infrastructure events, surfacing root cause in top 30-50 metrics. AI Co-Engineer provides natural language explanations of network patterns. Learn about ML Anomaly Detection.

Yes. Netdata eBPF monitoring is non-invasive and complements specialized tools. Use Cilium for network policy enforcement, Pixie for L7 protocol parsing, or traditional SNMP for network devices - while Netdata provides continuous infrastructure-level network observability with historical retention and ML-powered insights. Netdata’s unified dashboard correlates eBPF network metrics with system and application metrics automatically.

Traditional network monitoring uses /proc/net/ statistics (aggregated, delayed) or packet capture (high overhead). Netdata eBPF operates at the kernel level with per-second granularity and minimal overhead (<5% CPU). eBPF provides connection-level detail and process attribution - difficult with traditional methods. Netdata includes both: eBPF for kernel-level visibility plus traditional methods as fallback, ensuring continuous monitoring regardless of kernel capabilities.

Start with Netdata’s algorithmic dashboards showing bandwidth, connections, and retransmissions with anomaly ribbons. Use Anomaly Advisor to identify correlated infrastructure events during network spikes. Leverage Netdata Functions for real-time connection inspection. Ask AI Co-Engineer questions like ‘Why are retransmissions spiking?’ for natural language explanations. Historical retention enables forensic analysis of past incidents. Explore Troubleshooting Features.

Yes. Netdata eBPF monitoring tracks both IPv4 and IPv6 connections, bandwidth, and retransmissions. Metrics are automatically separated by IP version in dashboards. Connection tracking includes IPv6 addresses, ports, and states. All eBPF features (ML anomaly detection, AI troubleshooting, historical retention) work identically for IPv4 and IPv6 traffic.

Netdata eBPF automatically detects available kernel features and uses the optimal collection mode: CO-RE (Compile Once Run Everywhere) for modern kernels ≥5.5 with BTF support, trampolines for efficient function hooking, or legacy kprobes for older kernels ≥4.11. This automatic detection ensures optimal performance without manual configuration.