bpf

eBPF-based Networking, Security, and Observability

High-level tracing language for Linux

Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.

A curated list of awesome projects related to eBPF.

Kyanos is a networking analysis tool using eBPF. It can visualize the time packets spend in the kernel, capture requests/responses, makes troubleshooting more efficient.

eBPF-based Security Observability and Runtime Enforcement

Continuous profiling for analysis of CPU and memory usage, down to the line number and throughout time. Saving infrastructure cost, improving performance, and increasing reliability.

Aya is an eBPF library for the Rust programming language, built with a focus on developer experience and operability.

Linux Runtime Security and Forensics using eBPF

eBPF Developer Tutorial: Learning eBPF Step by Step with Examples

Packet, where are you? -- eBPF-based Linux kernel networking debugger

the TCPdump network dissector

the LIBpcap interface to various kernel packet capture mechanism

XDP tutorial

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF

Automated upstream mirror for libbpf stand-alone build.

bpftop provides a dynamic real-time view of running eBPF programs. It displays the average runtime, events per second, and estimated total CPU % for each program.

Prometheus exporter for custom eBPF metrics

Runtime Security Enforcement System. Workload hardening/sandboxing and implementing least-permissive policies made easy leveraging LSMs (LSM-BPF, AppArmor).

🕵️‍♂️ TUI for sniffing network traffic using eBPF on Linux