--- title: Network Observability: See Every Connection & DNS Query... description: Fairwinds Insights now includes Network Observability, a feature that captures cluster network traffic and DNS activity via eBPF (using Inspektor Gadget) and... canonical: https://daily.dev/posts/network-observability-see-every-connection-dns-query-in-the-cluster-t5zlk1hrq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Network Observability: See Every Connection & DNS Query in the Cluster | daily.dev og:description: Fairwinds Insights now includes Network Observability, a feature that captures cluster network traffic and DNS activity via eBPF (using Inspektor Gadget) and... og:url: https://daily.dev/posts/network-observability-see-every-connection-dns-query-in-the-cluster-t5zlk1hrq og:image: https://api.daily.dev/og/posts/T5zLk1hRq.png og:image:alt: Network Observability: See Every Connection & DNS Query in the Cluster og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Network Observability: See Every Connection & DNS Query in the Cluster **[Fairwinds Blog](https://daily.dev/sources/fairwinds-blog)** · 5 min read · 15 upvotes · 2 comments ## Summary Fairwinds Insights now includes Network Observability, a feature that captures cluster network traffic and DNS activity via eBPF (using Inspektor Gadget) and enriches it with Kubernetes metadata like pod, namespace, and workload owner. It runs as two components: a DaemonSet agent capturing TCP connections and DNS queries, and an aggregator that enriches and forwards the data to Insights. The UI offers a Service Map showing live traffic between namespaces and external endpoints, plus a DNS Summary sorted by failures, both backed by a filterable Live Events table supporting CSV export. Requirements include Linux nodes with bpf and debugfs filesystems; Windows nodes are unsupported. The feature became generally available on July 28, 2026. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are the node requirements to run Fairwinds Network Observability with eBPF? Nodes must run Linux with the bpf and debugfs filesystems available; Windows nodes are not supported. The agent also needs a set of elevated Linux capabilities and host filesystem mounts to attach eBPF programs, which the Helm chart configures automatically as long as the cluster permits them. _Teams evaluating eBPF-based network tooling for Kubernetes can track compatibility requirements like these via daily.dev._ ### How does Fairwinds Network Observability show which pods are talking to each other in a Kubernetes cluster? It captures TCP connections and DNS activity via an eBPF-based DaemonSet agent called network-flow, then an aggregator (network-flow-aggregator) enriches the raw flow data with Kubernetes metadata such as pod, namespace, and workload owner before forwarding it to Fairwinds Insights, where it renders as a live service map instead of raw IPs and ports. _Platform engineers debugging cross-namespace traffic issues can follow tooling like this on daily.dev._ ### When did Fairwinds Network Observability become generally available? It became generally available on July 28, 2026, as an extension of the Fairwinds Insights platform alongside its existing cost, policy, and security data. Existing Insights Agent users can enable it by adding network-observability: enabled: true to their values.yaml. _Anyone tracking new releases in the Kubernetes observability space can follow updates like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@agustinbarrientos** · 0 upvotes > Try adding workload rollout markers to the DNS failure timeline too **@trevorsuna** · 0 upvotes > Pairing eBPF connection data with Kubernetes ownership metadata makes this much more actionable than a raw packet view. The DNS failure summary looks especially useful during incidents, because it can quickly separate application errors from service discovery or upstream resolver trouble. ## Similar posts on daily.dev - [What's new in network observability 1.10](https://daily.dev/posts/what-s-new-in-network-observability-1-10-xylsm7dho) · Red Hat Developer · 1 upvotes · 0 comments - [Monitor network performance and traffic across your EKS clusters with Container Network Observability](https://daily.dev/posts/monitor-network-performance-and-traffic-across-your-eks-clusters-with-container-network-observabilit-jwtsbnmrm) · AWS · 0 upvotes · 0 comments - [Cloud Network Insights: End-to-end cross-cloud observability](https://daily.dev/posts/cloud-network-insights-end-to-end-cross-cloud-observability-qkn7h7ism) · Google Cloud · 0 upvotes · 0 comments - [Why Your Kubernetes Network is Still a Black Box — And How to Fix It](https://daily.dev/posts/why-your-kubernetes-network-is-still-a-black-box-and-how-to-fix-it-veqwpdzql) · Container Journal · 0 upvotes · 0 comments - [How DNS name tracking enhances network observability](https://daily.dev/posts/how-dns-name-tracking-enhances-network-observability-ywx3twxdn) · Red Hat Developer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#kubernetes](https://daily.dev/tags/kubernetes), [#observability](https://daily.dev/tags/observability), [#dns](https://daily.dev/tags/dns) [View this post on daily.dev](https://daily.dev/posts/network-observability-see-every-connection-dns-query-in-the-cluster-t5zlk1hrq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Network Observability: See Every Connection & DNS Query in the Cluster","url":"https://daily.dev/posts/network-observability-see-every-connection-dns-query-in-the-cluster-t5zlk1hrq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/network-observability-see-every-connection-dns-query-in-the-cluster-t5zlk1hrq"},"datePublished":"2026-08-13T19:10:22.780Z","dateModified":"2026-09-13T21:58:31.267Z","description":"Fairwinds Insights now includes Network Observability, a feature that captures cluster network traffic and DNS activity via eBPF (using Inspektor Gadget) and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/355c45cf4952cb5daadc6a81050bd600?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/355c45cf4952cb5daadc6a81050bd600?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Fairwinds Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Fairwinds Blog","logo":"https://media.daily.dev/image/upload/s--czVElT3y--/f_auto,q_auto/v1780213254/logos/fairwinds-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/fairwinds-blog"},"commentCount":2,"discussionUrl":"https://daily.dev/posts/network-observability-see-every-connection-dns-query-in-the-cluster-t5zlk1hrq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":15},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":2}],"keywords":"security,linux,kubernetes,observability,dns","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Fairwinds Blog","item":"https://daily.dev/sources/fairwinds-blog"},{"@type":"ListItem","position":3,"name":"Network Observability: See Every Connection & DNS Query in the Cluster"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/network-observability-see-every-connection-dns-query-in-the-cluster-t5zlk1hrq","comment":[{"@type":"Comment","text":"Try adding workload rollout markers to the DNS failure timeline too","datePublished":"2026-08-15T17:41:08.098Z","url":"https://daily.dev/posts/T5zLk1hRq#c-IspYtOEQs","author":{"@type":"Person","name":"Agustin Barrientos","url":"https://daily.dev/agustinbarrientos","image":"https://media.daily.dev/image/upload/s--5ayxQnqn--/f_auto/v1788281802/avatars/avatar_wQYYVe5Tbj0NJ7C7qPoa8?_a=BAMAMicg0"}},{"@type":"Comment","text":"Pairing eBPF connection data with Kubernetes ownership metadata makes this much more actionable than a raw packet view. The DNS failure summary looks especially useful during incidents, because it can quickly separate application errors from service discovery or upstream resolver trouble.","datePublished":"2026-08-15T02:48:33.357Z","url":"https://daily.dev/posts/T5zLk1hRq#c-Cysj0zYz9","author":{"@type":"Person","name":"Trevor Suna","url":"https://daily.dev/trevorsuna","image":"https://media.daily.dev/image/upload/s--dZ7gXxpp--/f_auto/v1784081551/avatars/avatar_EMoP47rpuw8DNjhp6R1b6?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/network-observability-see-every-connection-dns-query-in-the-cluster-t5zlk1hrq#faq","mainEntity":[{"@type":"Question","name":"What are the node requirements to run Fairwinds Network Observability with eBPF?","acceptedAnswer":{"@type":"Answer","text":"Nodes must run Linux with the bpf and debugfs filesystems available; Windows nodes are not supported. The agent also needs a set of elevated Linux capabilities and host filesystem mounts to attach eBPF programs, which the Helm chart configures automatically as long as the cluster permits them. Teams evaluating eBPF-based network tooling for Kubernetes can track compatibility requirements like these via daily.dev."}},{"@type":"Question","name":"How does Fairwinds Network Observability show which pods are talking to each other in a Kubernetes cluster?","acceptedAnswer":{"@type":"Answer","text":"It captures TCP connections and DNS activity via an eBPF-based DaemonSet agent called network-flow, then an aggregator (network-flow-aggregator) enriches the raw flow data with Kubernetes metadata such as pod, namespace, and workload owner before forwarding it to Fairwinds Insights, where it renders as a live service map instead of raw IPs and ports. Platform engineers debugging cross-namespace traffic issues can follow tooling like this on daily.dev."}},{"@type":"Question","name":"When did Fairwinds Network Observability become generally available?","acceptedAnswer":{"@type":"Answer","text":"It became generally available on July 28, 2026, as an extension of the Fairwinds Insights platform alongside its existing cost, policy, and security data. Existing Insights Agent users can enable it by adding network-observability: enabled: true to their values.yaml. Anyone tracking new releases in the Kubernetes observability space can follow updates like this on daily.dev."}}]} ```