See what your HTTP traffic is doing. Netkit is a Go proxy with a web dashboard for inspecting requests, finding slow responses, and investigating failures.
You’ll need Go 1.24.1+, Node.js 20+, npm, and Python 3.9+ for the demo.
git clone https://github.com/chaosslabs/netkit.git
cd netkit
make demoOpen localhost:13000. The demo builds Netkit and its dashboard, starts a local store API, and sends real traffic through the proxy:
- A successful catalog request: 200
- A JSON order submission: 201
- A slow upstream response: ~800 ms
- An unavailable service: 503
Run make demo-verify to send another batch and check the captures. Ctrl-C
stops the demo. No external API or credentials needed.
🎬 Watch the 48-second demo · Demo setup and ports
These screenshots come directly from the recorded demo at 1440×1000.
Traffic: filter captured requests and inspect status, headers, JSON bodies, and timing side by side.
Compose: send a request through the proxy and inspect its response.
Overview groups retained traffic by host and path, with failure counts and p95 time to response headers. Drill into a group to inspect its requests. More about the investigation workflow →
Build a standalone binary with the dashboard included:
make install-dashboard
make build-embedded
./bin/netkit serveThe normal server uses 3000 for the dashboard, 8080 for the proxy, and
8081 for the admin API. These differ from the demo’s ports.
Run ./bin/netkit serve --help for all configuration flags.
curl --proxy http://localhost:8080 http://example.com
# For applications that support proxy environment variables:
export HTTP_PROXY=http://localhost:8080
export HTTPS_PROXY=http://localhost:8080Prefer Docker? Build from this checkout:
docker build -t netkit:local .
docker run --rm -p 127.0.0.1:3000:3000 -p 127.0.0.1:8080:8080 netkit:localOpen localhost:3000. The dashboard accesses its admin API through the same port.
- HTTP: method, sanitized URL and headers, eligible JSON bodies, status, byte counts, and timing.
- HTTPS by default: CONNECT tunnel setup only. Encrypted requests stay opaque.
- Optional HTTPS inspection: decrypted exchanges when clients trust your inspection CA. See HTTPS setup.
- History: a bounded in-memory buffer, cleared on restart. Default capacity:
1,000 records; change it with
--history-size.
Sensitive fields are masked before retention. Only complete JSON bodies up to 64 KiB are retained; other bodies show omission markers. Redaction is not a general secret detector. See the capture policy.
Netkit has no proxy/dashboard authentication and binds its listeners to all interfaces. Keep it within a trusted development environment.
The admin API uses port 8081 by default. The dashboard also exposes these
routes under /api/admin.
| Endpoint | Purpose |
|---|---|
GET /healthz |
Health and capture mode |
GET /requests |
Retained request history |
GET /requests/stats |
Statistics for retained history |
GET /metrics |
Prometheus counters and histograms |
POST /requests/clear |
Clear retained history |
History statistics cover the current buffer. Prometheus counters survive history clearing and eviction, but reset when Netkit restarts.
For alerts and retained incident evidence, use the Prometheus + Alertmanager example.
make install-dashboard # Install frontend dependencies
make dev # Start backend and dashboard
make test # Go unit tests
make e2e # Go end-to-end tests
make check # Backend tests, lint, and buildDashboard checks: cd dashboard && npm run test:unit && npm run build.
Use Conventional Commits and open a PR with your change
and validation results.