Protocol support

There are 16 built-in Wasm packages. The HTTP family shares a package because it shares connection state. Support means the scope below, not every protocol version, extension, authentication mode, or replication mode.

Capability matrix

Protocol	Available features	Main limits
HTTP/1.x	Request-stage events, transactions, pipelining, chunked/trailers, gzip/deflate, upgrades	Unsupported Upgrade modes produce anomalies
HTTP/2	HPACK, concurrent streams, CONTINUATION, trailers, RST/GOAWAY, h2c	64 streams/connection; plaintext and SETTINGS context required
WebSocket	Handshake validation, fragmentation, control frames, UTF-8, hex auditing	permessage-deflate with context takeover; other extensions rejected; compressed/decoded messages each <=64 KiB
gRPC	Unary/streaming, trailer status, message counts, gzip, descriptor decoding	HTTP 200 is not RPC success; no guessed message types without descriptors
DNS UDP/TCP	Correlation, name compression, common records, TTL, all response sections	No DNSSEC validation or automatic DoH/DoT decryption
TLS	Hello, SNI, versions, ciphers, visible ALPN and TLS 1.2 certificates	No trust-chain validation; encrypted TLS 1.3 certificates/ALPN cannot be recovered from capture
MySQL	Ordinary/prepared requests, multi-results, parameters, long data, read-only cursors/FETCH	No binlog semantics; unsupported cursor modes rejected
PostgreSQL	Simple/extended, prepared requests, pipelines, COPY IN/OUT/BOTH	Replication payloads only get bounded auditing, not WAL semantics
Redis	Inline, RESP2/3, pipelines, subscriptions/push, MONITOR/RESET	No SYNC/PSYNC replication; credentials omitted
MongoDB	OP_MSG, BSON, ID correlation, snappy/zlib/zstd, CRC32C	Legacy OP_QUERY/REPLY only for hello; 1 MiB frames
Kafka	Produce v0–12, Fetch v0–17, batch v2, common compression	Other APIs are metadata-only; no non-length-framed SASL
MQTT	3.1.1/5.0, QoS 0/1/2, subscriptions, topic aliases, DUP	Must observe CONNECT; CONNECT/AUTH credentials omitted
AMQP	0-9-1 publish/deliver/get/return, publisher confirms	No AMQP 1.0; authentication exchange omitted
Dubbo	Dubbo 2, IDs, Hessian2 method metadata, responses/exceptions	No Triple, reverse requests, or full argument-object decoding
Thrift	Framed binary/compact, method/ID correlation, oneway, exceptions	No unframed, HeaderTransport, or reverse requests
Memcached	Classic ASCII, multi-key reads, non-quiet binary, hits/misses	No meta, UDP, binary quiet/STAT; noreply does not imply success
NATS	Core, PUB/MSG, HPUB/HMSG, exclusive same-connection reply correlation	No JetStream semantics, cluster routes, or WebSocket; observed publishing is not delivery
LDAP v3	Bind results, Search counts, ID correlation, modifications, Extended OIDs	Metadata only; no authentication/attribute/filter values, SASL security layer, or page aggregation
HTTP/3	Passive goquic plaintext, independent streams, FIN/reset, static QPACK	Supported quic-go only; no mirrored UDP decryption; see below

Requests, bodies, and decoding

http.request is off by default. When enabled, it emits after complete request headers. Only http.transaction contributes to HTTP business request counts. Query capture defaults to empty; default header allowlisting covers content-type/x-request-id/traceparent. Allowlisting does not bypass event redaction.

For gRPC, generate a descriptor set including dependencies:

protoc --include_imports --descriptor_set_out=service.pb service.proto

Add "grpc":{"descriptors":["./service.pb"]} to the main configuration and restart the analyzer. grpc.request_json/response_json contain JSON message arrays as strings, usable through DSL JSON pointers. decoded applies only to retained content: complete-content decisions also need not truncated and completeness checks. Unknown compression, missing context, and decoding failure do not imply health.

Passive HTTP/3

Use module=goquic and protocol=http3. Supported quic-go versions are v0.64.0 / v0.59.1, with runtime evidence on Linux arm64 / Go 1.26.9. Requirements include Linux ≥ 5.17, BTF, root, target ELF symbols, and DWARF. Stripped symbols, missing DWARF, unsupported dependency layouts, and other QUIC implementations reject attachment.

Static QPACK works; dynamic QPACK, server push, and WebTransport are explicitly rejected. Ordinary OpenSSL/Go TLS probes cannot substitute for the QUIC probe.

Inspect active capabilities

netflowscout plugin info --config /etc/netflowscout/netflowscout.json
netflowscout status --component analyzer --config /etc/netflowscout/netflowscout.json

Manifest capabilities describe implementation scope. Active versions, module hashes, and actual requests establish what is working locally. Two shards of built-ins declare 544 MiB of linear memory against a 640 MiB current-generation budget and 1280 MiB including draining generations. Declared limits are not RSS. Load only needed protocols to reduce the budget.