Meet the packet at the hook.
BTF-discovered probes identify the real kernel function and the real struct sk_buff * argument—without guessing field layouts.
skbx plan --probe ip_rcv --jsonLinux packet-path evidence
See where the
packet went.
Keep the receipts.
Trace SKBs through kernel functions, TC, XDP, tunnels, transforms, and drops—then replay the exact route from bounded evidence.
The familiar report
“The load balancer sent it.
The pod never saw it.”
There are a thousand places for certainty to disappear between those two sentences. skbx turns the gap into an ordered evidence stream.
Question
Where, exactly?
One packet. Five receipts.
Follow the evidence,
not the folklore.
Bound the observation.
Capture duration, state, packet parsing, and output are bounded. Every limit is part of the contract, not a footnote.
sudo skbx capture --duration 10 icmpGive evidence an address.
Every event receives a stable handle. Humans and agents can point to the same observation without paraphrasing it into fiction.
event:8c6f… skb:17 ip_rcvRebuild the route without root.
Replay groups ordered events into bounded routes, surfaces consensus and outliers, and turns a capture into a reproducible path.
skbx replay trace.jsonl --format jsonTrace every answer back.
Explanation starts from the handle and retrieves surrounding evidence. The engine reports what happened; AI may explain, never invent.
skbx explain trace.jsonl event:<handle>traceq / 0.1.0
A flight recorder
needs a black box.
Append-only JSONL. Mandatory header and footer. Stable handles. Explicit reliability telemetry. If the record is incomplete, skbx says so.
01
"type": "capture_start", "schema": "traceq/0.1.0"
02
"event": "event:8c6f…", "probe": "ip_rcv"
03
"skb": 17, "origin": "tracked", "mark": 42
04
"verdict": "drop", "reason": "DROP_POLICY"
05
"type": "capture_end", "reserve_failures": 0
Trust is observable
A missing footer
is evidence, too.
01
Loss has names.
Reserve, recursion, read, decode, enrichment, and output failures remain separate counters.
02
State has bounds.
Capture limits and rotation boundaries are emitted with the trace, so consumers know the observation window.
03
Agents get contracts.
describe, schema, doctor, and plan make capabilities inspectable before attachment.
Operational search, answered with evidence
Turn “the network is slow” into bounded questions.
Start at a machine you control. Preserve the local packet path, identify where direct evidence ends, and add another vantage only when the incident crosses that boundary.
SKB tracing
HTTPS latency
ISP boundary
packet drops
rootless replay
Agent-first by construction
Self-describing.
Deterministic.
Unimpressed by guesses.
An agent can inspect commands, capabilities, limits, invariants, and schemas before it touches the host. Machine output stays on stdout. Diagnostics stay on stderr.
Read the agent contractStart with the host, not a hypothesis.
Trace your first packet.
$ cargo install --git https://github.com/copyleftdev/skbx --locked skbx-cli