Sysdig: The Co-Creator of Wireshark Realized That in a World of Containers, Packets No Longer Told the Whole Truth

The story

Loris Degioanni's career is a story about observation. He helped build one of the most widely used tools for watching computer networks, and then founded a company because he believed the old way of watching no longer worked.

It started with a choice many Italian teenagers would have made differently. "I was 14 or 15, and I got a summer job as a bartender in Italy. I got enough money saved to buy myself either a computer or a scooter," Degioanni told Linux Format in an interview republished by TechRadar. "Everybody in Italy at that time wanted a scooter, and all my friends were buying them. I decided to buy the computer because I was so passionate about that, and that's where I started programming." The machine was an Amiga. At university, where he studied computer science, he installed Slackware Linux on a 486 "with a tower of floppies" and spent savings on more memory so he could run X Window. Having an operating system whose source code he could compile and study, he said, "was so powerful and fascinating for me."

His first serious software project came from a practical problem. He joined a computer networking group at his university in northern Italy, where the professor believed the best way to learn networks was to observe them. "The problem is, we absolutely couldn't afford to give a network analyzer to all of the students in the lab. And the other problem was that the labs at that point were running Windows," Degioanni said. "So, I got the project of hacking with the kernel of Windows to try to make a package capture library similar to the ones that were available for Unix and Linux." He also ported tcpdump to Windows and hosted everything on a small server. "By the time I graduated, that little computer under the desk was doing more traffic than the rest of the university combined. And that's how WinPCAP was born."

Across the Atlantic, Gerald Combs had built a protocol analyzer because the small ISP where he worked could not afford a commercial sniffer, and released it as open source. The two projects fit together. "We'd never met in person, but we created two things that were complementary. He created the user interface part and I created the capture engine for Windows," Degioanni said. The analyzer was originally called Ethereal. On the Contributor podcast, Degioanni explained that when he and Combs left university and Combs's employer to start their first business, built around commercial support for the tool, they could not afford the domain and trademark, which belonged to Combs's previous employer. "So what we did is we forked the project and just gave it a different name. That's the beauty of Open Source," he said. "The real value is the community." The new name was Wireshark.

That company was later acquired by Riverbed. Degioanni described his time there warmly but impatiently. "We did a successful acquisition. A great team at Riverbed, a lot of fun. But it's always like being an entrepreneur, and a company founder is something that when you do it once, it's hard to do something else in your life," he said. "I was very happy at Riverbed, but counting the days to be able to start something from scratch by myself with a little group of friends."

The new idea came from watching infrastructure change. Cloud computing and Docker were arriving, and, Degioanni said, these technologies were "very unfriendly from the point of view of getting this kind of visibility and observability from the network point of view. Because in the cloud, you don't have access to the routers anymore." Containers made it worse: customers were packing hundreds of containers onto single large machines, "And there's a lot of stuff that happens in these machines without hitting the wire on the network. So it was not true anymore that packets never lie." His mission became to "reinvent instrumentation and visibility in a way that reflects all of the beautiful properties of packets," but natively for cloud, containers and orchestrated microservices.

Sysdig's own history dates the founding to 2013, while Degioanni recalled on the podcast that he started the company in 2014. Either way, the first public product appeared in April 2014. Writing to the Wireshark developers' mailing list, he announced "sysdig, the latest open source project I've been working on together with the team at my new startup, Draios." "Sysdig tries to bring the network analysis workflow to Linux system troubleshooting, and is like a mix between tshark, strace and lsof," he wrote, adding that it could save system trace files in pcap-ng format and used a filtering language "very similar to what wireshark guys are used to." He closed with a request familiar to any open-source founder: "if you do enjoy using sysdig, we could really use your help spreading the word."

He was consciously repeating his student playbook. "When I was at the university in Italy, I first I built a packet capture driver and then I ported tcpdump, the famous command line tool to Windows," he said. "So with open-source Sysdig, we did something similar... we built a little command line tool that would be something like tcpdump for your system calls and for your containers." The company describes sysdig OSS as "The first tool to see inside containers at the syscall level."

Falco followed in 2016, after a couple of years building the core instrumentation. Degioanni compared it to "a security camera for modern infrastructure," software plugged into different parts of a cloud environment that sees inside containers and hosts and brings detections into one place. Sysdig contributed Falco to the Cloud Native Computing Foundation, and the company said in December 2021 that it had been downloaded over 37 million times, with a 335% increase since becoming an incubating CNCF project in January 2020. Degioanni later said it had passed 60 million downloads, with maintainers from more than 10 organizations, including AWS, IBM, Red Hat and Sysdig. The Contributor episode also covered his work with Combs as a student and why his teams name products after animals.

The commercial business grew on top of that open-source base. On December 15, 2021, Sysdig announced a $350 million Series G at a $2.5 billion valuation, led by Permira's growth fund, bringing total funding to $744 million and more than doubling its valuation in eight months. It reported nearly 700 customers, a 140% year-on-year increase, and an annual net revenue retention of 149%. By then Suresh Vasudevan was CEO, and Degioanni's title on the company's site is CTO and founder. "Having created WinPcap, Wireshark, and Falco, I know how satisfying it is to pour your heart into a piece of free software and watch a community grow up around it," he is quoted there.

Degioanni's second company was built on a sharp observation about his first: the assumptions behind packet analysis broke when work moved inside dense container hosts. Instead of abandoning what he knew, he moved the same idea, deep and honest visibility, down to the level of system calls, and launched it the same way, as a free command-line tool for engineers. His willingness to step aside as CEO while staying on as CTO also shows a founder who knew where his strengths were. The story suggests that expertise is most valuable when you notice exactly where it stops applying.