bpf

eBPF-based Networking, Security, and Observability

High-level tracing language for Linux

Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.

A curated list of awesome projects related to eBPF.

Kyanos is a networking analysis tool using eBPF. It can visualize the time packets spend in the kernel, capture requests/responses, makes troubleshooting more efficient.

eBPF-based Security Observability and Runtime Enforcement

Continuous profiling for analysis of CPU and memory usage, down to the line number and throughout time. Saving infrastructure cost, improving performance, and increasing reliability.

Aya is an eBPF library for the Rust programming language, built with a focus on developer experience and operability.

Linux Runtime Security and Forensics using eBPF

eBPF Developer Tutorial: Learning eBPF Step by Step with Examples

Packet, where are you? -- eBPF-based Linux kernel networking debugger

the TCPdump network dissector

the LIBpcap interface to various kernel packet capture mechanism

XDP tutorial

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF

Automated upstream mirror for libbpf stand-alone build.

bpftop provides a dynamic real-time view of running eBPF programs. It displays the average runtime, events per second, and estimated total CPU % for each program.

Prometheus exporter for custom eBPF metrics

Runtime Security Enforcement System. Workload hardening/sandboxing and implementing least-permissive policies made easy leveraging LSMs (LSM-BPF, AppArmor).

🕵️‍♂️ TUI for sniffing network traffic using eBPF on Linux

Schedule bpftrace programs on your kubernetes cluster using the kubectl

bpftune uses BPF to auto-tune Linux systems

Solidity Compiler for Solana, Polkadot and Stellar

Process-aware, eBPF-based tcpdump

Library to work with eBPF programs from Go

Rust virtual machine and JIT compiler for eBPF programs

Minimal and opinionated eBPF tooling for the Rust ecosystem

The main libseccomp repository

A firewall that utilizes the Linux kernel's XDP hook. The XDP hook allows for very fast network processing on Linux systems. This is great for dropping malicious traffic from a (D)DoS attack. IPv6 is supported with this firewall! I hope this helps network engineers/programmers interested in utilizing XDP!

eBPF library for Go. Powered by libbpf.