Mermin is a powerful, Kubernetes-native network observability tool that uses eBPF to efficiently capture network traffic and export it as Flow Traces via the OpenTelemetry Protocol (OTLP). It provides deep visibility into your cluster's network communications with zero application changes required.

Why Mermin?

The Problem

Your APM traces show application behavior. Your network monitoring shows IP-level statistics. But there's a gap: when a trace shows a slow network span, you have no way to correlate that with actual network flow data. When network teams see congestion, they can't map it back to specific services or pods.

The MELT stack (Metrics, Events, Logs, Traces) is missing network flow data—connection-level information that bridges application performance with network reality.

What Mermin Does

Mermin captures network traffic using eBPF and exports it as Flow Traces—network flows represented as OpenTelemetry spans. This brings network visibility into the OTel ecosystem using a standard signal type.

The "Sweet Spot": Why Flow Data?

Observability involves trade-offs between granularity and overhead. Flow data sits between two extremes:

Not Raw PCAP: Full packet capture is expensive to store and query. Mermin aggregates packets into flows—you get connection-level detail without payload overhead.
Not Just Counters: Metrics tell you bandwidth usage but miss connection context—timing, retransmissions, directionality.

Flow data provides granular, connection-level detail that's lightweight enough to run always-on in production.

Key Capabilities

Auto-Instrumentation for Your Network Stack: Just as eBPF-based APM tools auto-instrument application code, Mermin auto-instruments your network layer. Deploy once per node, get visibility into all traffic—no per-service configuration required.
Kubernetes-Native Enrichment: Flows include Pod, Service, and Deployment metadata. You see frontend-service → redis-cache, not 10.42.0.5 → 10.42.0.8.
Zero Code Changes: eBPF captures traffic transparently—no sidecars, no application modifications, no service mesh required.
Standards-Based Export: Native OTLP output integrates with your existing observability stack (Tempo, Jaeger, Elastic, etc.).
Production-Ready: Low-overhead kernel-level capture designed for always-on operation.

Quick Start

The fastest way to get started with Mermin is to deploy it to a local Kubernetes cluster using our quickstart guide:

Follow the Complete Quickstart Guide

Or deploy directly with Helm:

helm repo add elastiflow https://elastiflow.github.io/mermin
helm install mermin elastiflow/mermin --namespace mermin --create-namespace

Once deployed, Mermin runs as a DaemonSet with one pod per node, automatically capturing network traffic and exporting Flow Traces to your configured OTLP endpoint.

How It Compares

| Feature | Mermin | eBPF APM Agents | Traditional NetFlow/IPFIX | Service Mesh (Istio/Linkerd) | Packet Capture Tools | |------------------------|------------------------|------------------------|---------------------------|------------------------------|-----------------------| | Kubernetes Context | ✅ Native | ✅ Native | ❌ None | ✅ Native | ❌ None | | Application Changes | ✅ Zero | ✅ Zero | ✅ Zero | ❌ Sidecar injection | ✅ Zero | | Network Data Type | ✅ Flow Records | ❌ Counters only | ✅ Flow Records | ⚠️ Request/response | ✅ Full packets | | Connection Context | ✅ Full details | ❌ Aggregated metrics | ✅ Full details | ⚠️ L7 only | ✅ Full packets | | Performance Overhead | ✅ Minimal (eBPF) | ✅ Minimal (eBPF) | ✅ Low | ⚠️ Moderate (sidecars) | ❌ High (full capture) | | Standards-Based Export | ✅ OTLP Traces | ⚠️ OTLP Metrics | ⚠️ NetFlow/IPFIX | ⚠️ Prometheus/vendor-specific | ❌ PCAP files | | Bidirectional Flows | ✅ Yes | ❌ Separate counters | ✅ Yes | ⚠️ Limited | ❌ Packet-level only | | Deployment Complexity | ✅ Simple DaemonSet | ✅ Simple DaemonSet | ✅ Simple | ⚠️ Complex | ✅ Simple |

Key Differentiators:

vs eBPF APM Agents: Exports flow records (with timing, flags, directionality) as traces, not aggregated counter metrics
vs NetFlow/IPFIX: Adds Kubernetes context and uses modern OTLP standard
vs Service Meshes: No application changes, lower overhead, but L3/L4 only (not L7)
vs Packet Capture: Aggregated flows instead of raw packets, with metadata enrichment

Architecture at a Glance

Mermin operates as a DaemonSet in Kubernetes (or as a privileged container on bare metal), with one instance running on each node:

Packet Capture: eBPF programs attached to network interfaces capture packets at the kernel level.
Flow Aggregation: Packets are aggregated into bidirectional network flows with connection state tracking.
Metadata Enrichment: Flows are decorated with Kubernetes metadata (pods, services, deployments, labels).
Flow Traces Export: Flows are converted to OpenTelemetry trace spans and exported via OTLP
Observability Backend: Flow Traces are stored, analyzed, and visualized in your platform (Elastic, Grafana Tempo, Jaeger, etc.)

For a deeper dive into Mermin's architecture, see our Architecture Overview.

Documentation

Comprehensive documentation is available in the docs/ directory and via docs.mermin.dev:

Getting Started

Quickstart Guide - Get up and running in minutes
Architecture Overview - Understand how Mermin works

Deployment

Deployment Guide - Deployment strategies and best practices
Kubernetes with Helm - Kubernetes deployment details
Cloud Platforms - AWS, GCP, Azure specifics
Docker & Bare Metal - Non-Kubernetes deployments

Configuration

Configuration Reference - Complete configuration options
OTLP Export - Configure OpenTelemetry export
Filtering - Control which flows are captured
Kubernetes Metadata - Kubernetes integration options

Observability Backends

Supported Backends - Elastic, Grafana, Tempo, Jaeger, and more

Troubleshooting

Troubleshooting Guide - Common issues and solutions
Deployment Issues - Pod startup and configuration problems
Interface Visibility - Traffic capture and CNI configuration
Common eBPF Errors - Verifier failures and kernel compatibility

Development & Contributing

Contributing Guide - How to contribute to Mermin
Development Workflow - Build, test, and contribute
Debugging eBPF Programs - eBPF debugging techniques
Debugging Network Traffic - Wireshark and packet analysis

Contributing

We welcome contributions from the community! Whether you're fixing bugs, adding features, improving documentation, or sharing feedback, your contributions help make Mermin better for everyone.

Ways to Contribute

🐛 Report bugs via GitHub Issues.
💡 Request features or share ideas in GitHub Discussions.
📝 Improve documentation - PRs for doc improvements are always welcome.
🔧 Submit code - See our Development Workflow to get started.
💬 Help others - Answer questions in Discussions or Slack.

Getting Started as a Contributor

Read the Development Workflow - Learn how to build, test, and develop Mermin.
Check out Good First Issues - Find beginner-friendly tasks.
Join the conversation - Connect with us on Slack or GitHub Discussions.

All contributors are expected to follow our code of conduct and maintain a welcoming, inclusive environment.

Community & Support

Get Help:

Slack Channel: https://join.slack.com/t/elastiflowcommunity/shared_invite/zt-23jpnlw9g-Q4nKOwKKOE1N2MjfA2mXpg - Liv

Mermin

Install / Use

README