A curated list of awesome projects related to eBPF.
This page lists names, links and short descriptions. The original list on GitHub is the source and belongs to its authors.
A gateway to discover all the basics of eBPF, including a listing of the main related projects and of community resources.
In-depth documentation about most features and aspects of eBPF.
Providing technical documentation for eBPF.
Index for BPF-related documentation coming with the Linux kernel.
eBPF specification (somewhat outdated; information should still be valid, but not exhaustive).
Frequently Asked Questions on the decisions behind the BPF infrastructure.
Frequently Asked Questions about contributing to eBPF development.
Manual page about the bpf() system call, used to manage BPF programs and maps from userspace.
Manual page about using BPF with tc, including example commands and samples of code.
Description of the in-kernel helper functions forming the BPF standard library.
IETF specification for eBPF
Work in progress, contributions welcome.
BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
An accessible introduction providing context, history, and details about the functioning of eBPF.
They have a few posts about eBPF:
BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
An introduction mostly covering the tracing aspects.
An introduction mostly covering the tracing aspects.
An introduction mostly covering the tracing aspects, first part with flame graphs.
Also introduces IO Visor project.
Presentation by the author of eBPF.
A blog post from 2014 on the development of BPF and demonstrating what can be done with it, using an example of stateful socket filtering by attaching an eBPF program to a socket.
A description of all existing hooks for BPF program types, and of their interest.
A review of the kernel functions that can be called from within eBPF programs.
How BPF communicates with userspace - BPF maps, perf events, bpf_trace_printk.
Setting up your environment to build BPF programs.
How does BPF ensure that programs are safe?
One eBPF usage about packet transformation.
A blog post covering the basics of eBPF as well as code samples in Go on how to build and load a minimal eBPF program into the kernel.
A short paper describing the fundamentals of eBPF and how to get started with writing eBPF programs.
Different blog posts about networking use cases and low-level aspects of eBPF.
An in-depth collection of information around examples of performance analysis tools using eBPF. Contains also a section at the end of the page about other resources.
A set of live-coding talks and the accompanying code examples, introducing eBPF programming using a variety of libraries and program types.
Links to many community blogs posts.
Details on eBPF, its use for tunneling and encapsulation, direct packet access, and more.
Part of this tc workshop.
Introduction to eBPF, including several features (map management, tail calls, verifier). The full paper is also available here.
Linux networking internals, with a part about eBPF.
A detailed introduction to tracing with eBPF, from listing the available trace points to running bpftrace programs.
Kprobes, uprobes, ftrace.
Systemtap, Kernelshark, trace-cmd, LTTng, perf-tool, ftrace, hist-trigger, perf, function tracer, tracepoint, kprobe/uprobe, and more.
A very accessible introduction to XDP, providing sample code to show how to process packets.
In-depth documentation about most features and aspects of eBPF.
The first presentation about XDP.
Contains some benchmark results obtained with the mlx4 driver.
Linux Kernel's fight against DPDK. Future plans (as of this writing) for XDP and comparison with DPDK.
Additional hints about XDP internals and expected evolution.
Details and use cases about XDP, with benchmark results, and code snippets for benchmarking as well as for basic DDoS protection with eBPF/XDP (based on an IP blacklisting scheme).
Advanced details about current memory issues faced by XDP developers.
How to get started with eBPF and XDP for normal humans. Also summarized by Julia Evans on her blog.
Update on XDP, and in particular on the redirect actions.
About packet filtering on Linux, DDoS protection, packet processing in the kernel, kernel bypass, XDP and eBPF.
Cloudflare's blog post talking about their move to using XDP for packet filtering.
Kernel documentation on the AF_XDP address family.
A blog post by Cilium on the motivations behind eBPF and bpfilter, with a couple examples and links to other projects using eBPF and bpfilter.
Slides from a talk by Quentin Monnet with a background on eBPF and comparing bpfilter to iptables.
Kernel documentation about BTF, explaining how to use it.
A description of the work done with BTF to provide debugging information for BPF programs.
A community-authored newsletter enriched with useful code illustrations and hands-on examples.
The original paper about (classic) BPF.
Usage of BPF bytecode with the xt_bpf module for iptables.
Hardware offload for eBPF with TC or XDP (Linux kernel 4.9+), introduced by Netronome.
An update on the topic above.
An eBPF CPU written for FPGAs.
Computational Storage simulation (QEMU) platform with FUSE LFS filesystem for Zoned Namespaces NVMe SSDs using uBPF for compute kernel offloading, all in userspace.
Delilah is a Computational Storage Processor (CSP) built for eBPF offload to storage devices.
Browser-based playground to learn, write, compile, and run eBPF programs.
BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
Helps generate minimal or advanced templates to bootstrap your own applications (kernel side and user space management for maps and programs) with features like CO-RE, global variables, and ring buffer.
A thorough walk-through of how to write eBPF programs, first using only bpf() syscall, and then libbpf library, with reproducible code examples.
Involves the use of several BPF tools for tracing.
Troubleshooting ping requests and replies with perf and bcc programs.
Operated by Netronome: some tutorials for network-related eBPF use cases, including an eBPF Offload Starting Guide.
How to get started with eBPF and XDP for normal humans. Also summarized by Julia Evans on her blog.
Second edition, with new contents.
A progressive (three levels of difficulty) tutorial to learn how to process packets with XDP.
A step-by-step walkthrough to integrate tracing capabilities in your C++ applications with the LLVM libraries.
A simple guide to build basic firewalls with TC and XDP.
A detailed explanation of methods used to capture DNS requests at the socket filter layer.
Start with eBPF basics and progress to advanced topics using 20+ hands-on tutorials and examples. Covers performance, networking, and security with libbpf and CO-RE. Available in Chinese and English.
A step-by-step guide to benchmarking both the client and kernel eBPF code written in Rust.
Newsletter about all the ways to loop and iterate in eBPF.
A step-by-step guide how eBPF can observe encrypted network traffic.
A step-by-step guide how eBPF can observe Redis communication between client and server.
A step-by-step guide on how to implement a transparent proxy using eBPF.
Learn how eBPF can infer custom load-balancing for services listening on the same port, through the SO_REUSEPORT TCP option.
Learn how you can unit test your eBPF programs using libbpf.
Learn how eBPF can speed-up local socket communication up to 30%.
A step-by-step guide to write an appliation continuous profiler leveraging the eBPF instrumentation, with a complete project as a reference.
An introductory guide to writing image-based eBPF gadgets and sharing them via OCI registries.
An introductory guide to writing image-based eBPF gadgets and performing post-processing with WASM.
List of community developed labs.
In the kernel tree: some sample eBPF programs.
In the kernel tree: Linux BPF selftests, with many eBPF programs.
Jesper Dangaard Brouer's prototype-kernel repository contains some additional examples that can be compiled outside of kernel infrastructure.
Some networking programs to attach to the TC interface.
Provides basic but complete examples of eBPF applications also compatible with hardware offload.
BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
A heavily commented sample demonstrating how to encapsulate and decapsulate MPLS within IP. The code is commented for those new to BPF development.
A collection of compiled (as ELF object files) samples gathered from several projects, primarily intended to serve as test cases for user space verifiers.
A fully documented and tested example of an eBPF probe that logs all force-kills and prints them out in user-space.
Example programs for using RedBPF to write eBPF programs in Rust.
Program that uses XDP/TC-eBPF to provide statefull firewalling and socket redirection.
BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
Package containing tools for network management on Linux. In particular, it contains tc, used to manage eBPF filters and actions, and ip, used to manage XDP programs. Most of the code related to BPF is in lib/bpf.c.
The development tree, synchronised with net-next.
Contains several tools used in eBPF workflows. Snapshots of the latest versions for Ubuntu/Debian can be retrieved from here.; clang is used to compile C to eBPF object file under the ELF format (clang v3.7.1+). The BPF backend was added with this commit.; llvm-objdump is used to dump the content…
A C library used for handling BPF objects (programs and maps), and manipulating ELF object files containing them. It is shipped with the kernel and mirrored on GitHub.
Scaffolding for BPF application development with libbpf and BPF CO-RE.
Pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.
eBPF library for Go, powered by libbpf.
A pure Rust library for writing, loading, and managing eBPF objects, with a focus on developer experience and operability. It supports writing eBPF programs in Rust and distributing library code over crates.io to share it between eBPF programs. Aya does not depend on libbpf.
Templates for writing BPF applications in Aya that can be used with cargo generate.
A pure Zig framework for writing cross platform eBPF programs, powered by libbpf and Zig toolchain.
A compilation framework and runtime library to build, distribute, dynamically load, and run CO-RE eBPF applications in multiple languages and WebAssembly. It supports writing eBPF kernel code only (to build simple CO-RE libbpf eBPF applications), writing the kernel part in both BCC and libbpf…
Also some other tools in the kernel tree, under linux/tools/net/ for versions earlier than 4.15, or linux/tools/bpf/ after that:
A minimal cBPF assembler.
A small debugger for cBPF programs.
A disassembler for both BPF flavors and could be highly useful for JIT debugging.
Written in C. Contains an interpreter, a JIT compiler for x86_64 architecture, an assembler and a disassembler.
With support for FreeBSD kernel, FreeBSD user space, Linux kernel, Linux user space and macOS user space. Used for the VALE software switch's BPF extension module.
Written in Rust. Interpreter for Linux, macOS and Windows, and JIT-compiler for x86_64 under Linux.
A user space verifier for eBPF using an abstract interpretation layer, with support for loops.
A tracing profiler that aims to make eBPF uprobe-based debugging easier to use. This is done by displaying traces in a UI next to the source code and allowing interactive drilldown analysis.
This project is a work-in-progress that allows using existing eBPF toolchains and APIs familiar in the Linux ecosystem to be used on top of Windows.
Boots real Linux kernels in disposable QEMU/KVM VMs to load- and attach-validate compiled eBPF objects across a multi-distro, multi-architecture kernel matrix, classifying failures (missing BTF, unsupported map/program type, CO-RE relocations); runs as a CI gate and GitHub Action.
Related to the former item. Audio interview of John Fastabend by Ben Pfaff, one of the core maintainers of Open vSwitch.
project (GitHub repository) is a technology relying on eBPF and XDP to provide "fast in-kernel networking and security policy enforcement for containers based on eBPF programs generated on the fly". Many presentations available (with overlap):
Also featuring a load balancer use case
BPF & XDP for containers.
Interview of Thomas Graf by Ben Pfaff.
Generic introduction to Cilium.
Ivan Pepelnjak interviewing Thomas, October 2016, on eBPF, P4, XDP and Cilium.
A layer 4 load-balancer based on XDP, open-sourced by Facebook.
Protection against DDoS with XDP at Cloudflare.
Protection against DDoS with XDP at Facebook.
Common Ethernet Driver Framework for faster network I/O, a technology initiated by Mellanox.
Extreme Performance Tuning guide - Mark II.
Calico is an open source networking and network security solution for containers, virtual machines, and native host-based workloads. Calico's eBPF data plane delivers a low latency, high throughput data plane with a rich network security policy model.
Use eBPF to speed up your Service Mesh. Merbridge replaces iptables rules with eBPF to intercept traffic. It also combines msg_redirect to reduce latency with a shortened datapath between sidecars and services.
An open-source C++ library for capturing, parsing and crafting network packets. It features a C++ interface for creating AF_XDP sockets, making it easy to send and receive packets through them.
A high performance and lightweight captive portal solution for wireless networks. It leverages eBPF for traffic control and deep packet inspection capabilities, with plans to gradually replace nftables firewall functionality with eBPF-based solutions.
A proof-of-concept IPX implementation for Linux using eBPF.
The first presentation about XDP.
Helps with measuring power consumption for servers and uses eBPF programs for in-kernel aggregation of data.
Observability for Kubernetes using eBPF. Features include protocol tracing, application profiling, and support for distributed bpftrace deployments.
Apache SkyWalking is an open-source Application Performance Monitoring (APM) platform specially designed for distributed systems with microservices, cloud-native and container-based (Kubernetes) architectures. SkyWalking Rover is an eBPF-based profiler and metrics collector for C, C++, Golang, and…
eBPF based always-on continuous profiler for analysis of CPU and memory usage, down to the line number and throughout time.
Sampling profiler and tracer for Ruby.
Sub-millisecond system monitoring using eBPF tracepoints on sched_switch, sched_process_exit, and sched_process_free, with zero heap allocations in steady state.
eBPF-based GPU causal observability agent. Traces CUDA Runtime and Driver APIs via uprobes and host kernel events via tracepoints to build causal chains explaining GPU latency, with <2% overhead.
Instant Kubernetes service dependency map generated by eBPF, right to a Grafana instance.
eBPF-based pod-level kernel metrics collector for Kubernetes. Exports per-pod CPU, network, memory, syscall, disk I/O, and L7 protocol metrics to Prometheus. BPF programs are defined using a Kotlin DSL instead of C.
Instant observability for cloud-native and AI applications based on eBPF.
Coroot is an open-source APM and observability tool, a DataDog and NewRelic alternative.
Kyanos is an eBPF-based network issue analysis tool that enables you to capture network requests, such as HTTP, Redis, and MySQL requests.
eTraceGen is a Linux telemetry engine built with eBPF and Modern C++ that captures kernel-level events for processes, files, system calls, and network with a modular pipeline for decoding, enrichment, filtering, and JSON output.
A cloud-native runtime security project used as a Kubernetes threat detection engine.
A security monitoring tool. It depends on SysinternalsEBPF.
Red Canary has started to incorporate eBPF to their Linux security sensor.
A runtime security and forensics tool for Linux which uses eBPF technology to trace the system and applications at runtime, and analyze collected events to detect suspicious behavioral patterns.
A set of BPF programs that gather security relevant event data from the Linux kernel. The BPF programs are combined into a single ELF file from which individual probes can be selectively loaded, depending on the running operating system and kernel version.
An eBPF driven security tool for locking and auditing Linux machines.
Kubernetes-aware, eBPF-based security observability and runtime enforcement.
Trace syscalls from user-space functions, by using eBPF.
Extended detection and response (XDR) with eBPF-powered firewall and proxy, to protect your Linux servers.
BpfJailer is an eBPF-based process jailing system that provides mandatory access control (MAC) for Linux.
An eBPF-based security agent written entirely in Rust using the Aya library and built on LSM (Linux Security Module) BPF hooks.
Open source agent that implements a stateful Sigma rules engine focused on monitoring and prevention using eBPF LSM.
A self-defending security agent for Linux and macOS that uses eBPF with 22 kernel hooks (tracepoints, kprobes, LSM, XDP) via the Aya library for real-time threat detection, automated response, and AI-powered triage.
A small but flexible open source dynamic tracer for Linux, with features similar to the bcc tools, but with a simpler language inspired by awk and DTrace.
A tool for tracing with its own high-level tracing language. It is flexible enough to be envisioned as a Linux replacement for DTrace and SystemTap.
Summary and cheat sheet for programming in bpftrace. Contains information about syntax, probe types, variables and functions.
A kubectl plug-in for executing bpftrace programs in a Kubernetes cluster.
A collection tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF.
Framework for running BPF programs with rules on Linux as a daemon. Container aware.
A distinct BPF daemon, trying to leverage the flexibility of the bcc tools to trace and debug remote targets, and in particular devices running with Android.
A Linux shell environment for using tracing tools on Android with BPFd.
System daemon to compile and load eBPF programs into the kernel, and forward program output to socket for metric aggregation.
Considers using eBPF.
An in-kernel solution based on XDP for 5G UPF.
Example programs for using RedBPF to write eBPF programs in Rust.
A web interface to explore system's maps and programs.
A TUI (terminal user interface) application for real time monitoring of eBPF programs.
An eBPF Manager for Linux and Kubernetes. Includes a built-in program loader that supports program cooperation for XDP and TC programs, as well as deployment of eBPF programs from OCI images.
A process-aware, eBPF-based tcpdump-like tool.
A TUI for sniffing network traffic using eBPF on Linux.
A DWARF-aware eBPF tracer for source-level userspace tracing, with an interactive TUI and a scriptable CLI.
Zero-instrumentation eBPF observability for LLM and coding agents, capturing syscall-level traces (file, network, process) without modifying the agent.
OS-level agent harness that compiles a policy DSL to an in-kernel eBPF engine for labeled information-flow control at the syscall boundary, enforcing constraints across any tool or subprocess.
A series of posts around the introduction into BPF with a focus to an offensive setting, and also how its misuse can be detected. Posts include discussions on the rootkit capabilities of eBPF, or on which tracing type is needed for different use cases.
Blog post about how BPF can help detection and blocking fileless malware.
Talk about an eBPF rootkit and how the capabilities of eBPF could be abused. The rootkit was also the object of a talk at Defcon, eBPF, I thought we were friends !.
A rootkit that leverages multiple eBPF features to implement offensive security techniques.
An utility to statically analyze eBPF bytecode or monitor suspicious eBPF activity at runtime. It was specifically designed to detect ebpfkit.
A collection of malicious eBPF programs that make use of eBPF's ability to read and write user data in between the usermode program and the kernel.
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
with linux/include/uapi/bpf.h: definitions related to eBPF, to be used respectively in the kernel and to interface with userspace programs.
with linux/include/uapi/filter.h: information used to run the BPF programs themselves.
This directory contains most of BPF-related code. In particular, those files are worth of interest:
Different operations permitted by the system call, such as program loading or map management.
BPF interpreter.
BPF verifier.
Functions and eBPF helpers related to networking (TC, XDP etc.); also contains the code to migrate cBPF bytecode to eBPF (all cBPF programs are translated to eBPF in recent kernels).
Functions and eBPF helpers related to tracing and monitoring (kprobes, tracepoints, etc.).
and in particular in files act_bpf.c (action) and cls_bpf.c (filter): code related to BPF actions and filters with TC.
contains the function dev_change_xdp_fd() that is called through a Netlink command to hook a XDP program to a device, after is has been loaded into the kernel from user space. This function in turns uses a callback from the relevant driver.
BPF patches land in this tree. It is regularly merged into net-next, which is itself merged for each release to Linus' tree.
About contributions to BPF.
Mailing list for Linux kernel networking stack development. All patches are sent there for review and inclusion.
A mailing list specially dedicated to XDP programming (both for architecture or for asking for help).
A GitHub repository with notes and ideas regarding the future evolutions of XDP.
BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
The first presentation about XDP.
jaywcjlove/awesome-mac
This project is dedicated to collecting high-quality macOS software and organizing them systematically by different categories for easy search and use.
serhii-londar/open-source-mac-os-apps
🚀 Awesome list of open source applications for macOS. https://t.me/s/opensourcemacosapps
ramitsurana/awesome-kubernetes
A curated list for awesome kubernetes sources :ship::tada:
sindresorhus/awesome-nodejs
:zap: Delightful Node.js packages and resources [BECAUSE OF TOO MUCH SPAM AND LOW-QUALITY SUBMISSIONS, SUBMISSIONS ARE PAUSED TEMPORARILY]
frenck/awesome-home-assistant
A curated list of amazingly awesome Home Assistant resources.
vsouza/awesome-ios
A curated list of awesome iOS ecosystem, including Objective-C and Swift Projects