Record and Replay Testing

Record and replay testing captures real application traffic (API requests, responses, and dependency interactions) during normal operation and replays it as automated test cases. Unlike traditional test authoring, record-replay generates tests from actual production behavior, ensuring tests reflect real-world usage patterns rather than hypothetical scenarios.

Proxy-based tools route traffic through an intermediary, which requires network reconfiguration, alters TLS termination, adds measurable latency, and can only capture HTTP-layer traffic. Keploy uses eBPF probes in the Linux kernel to passively observe all network syscalls — capturing HTTP, gRPC, database wire protocols, Redis commands, and message queue traffic in a single session with zero network changes and sub-microsecond overhead.

VCR libraries (Ruby VCR, Python vcrpy, Go go-vcr) hook into language-specific HTTP client libraries, so they can only record outbound HTTP calls. Keploy operates at the kernel network layer, intercepting all TCP/IP traffic regardless of protocol or library. This means database queries (PostgreSQL, MongoDB, DynamoDB), cache operations (Redis, Memcached), and message queue interactions (Kafka, RabbitMQ) are all captured and mocked automatically.

Traditional record-replay requires engineers to manually identify and exclude non-deterministic fields (timestamps, UUIDs, session tokens) through regex patterns or field path configs. Keploy's AI analyzes multiple recordings of the same endpoint, statistically identifies varying fields, and automatically excludes them from strict assertions. As schemas evolve, the AI adapts without requiring manual exclusion rule updates.

Time-dependent logic (JWT expiry validation, cache TTLs, date-based database partitioning, cron-triggered behavior) fails during replay because the system clock has advanced past the recording time. Keploy freezes the system clock at the kernel level to match the original recording timestamp, so all time-dependent code paths produce identical results. No other record-replay tool offers kernel-level time manipulation without application code changes.

Keploy's eBPF probes add less than 1% CPU overhead and sub-microsecond latency per network call during recording. Storage depends on traffic volume — a typical API service generates 1-10 MB of recordings per hour of production traffic. Keploy's deduplication reduces stored test cases by 60-80% by identifying redundant recordings that exercise the same code paths.

When APIs evolve, Keploy's noise detection automatically identifies new or modified fields and adjusts assertions accordingly. For breaking changes, Keploy flags specific field-level diffs rather than failing the entire test, making it clear which schema changes caused the regression. Teams can then re-record affected tests from fresh traffic in a single session rather than manually updating dozens of test fixtures.

Application-layer middleware (Express middleware, Spring interceptors, WSGI wrappers) only captures traffic that reaches the application after framework processing. It misses requests rejected by load balancers, TLS errors, malformed requests, and framework-level routing failures. Keploy's kernel-level eBPF capture sees all network traffic entering the process, including edge cases that application middleware never observes.