awesome-ebpf

eBPF collection

A curated list of projects and resources related to the eBPF virtual machine

A curated list of awesome projects related to eBPF.

GitHub
4k stars
118 watching
368 forks
last commit: 1 day ago
Linked from 3 awesome lists

awesomeawesome-listbccbpfebpfhacktoberfestio-visorlinux-bpf-superpowersxdp

Awesome eBPF / Reference Documentation / eBPF Essentials
ebpf.io A gateway to discover all the basics of eBPF, including a listing of the main related projects and of community resources
Cilium's BPF and XDP Reference Guide In-depth documentation about most features and aspects of eBPF

Awesome eBPF / Reference Documentation / Kernel Documentation
BPF Documentation Index for BPF-related documentation coming with the Linux kernel
linux/Documentation/networking/filter.rst eBPF specification (somewhat outdated; information should still be valid, but not exhaustive)
BPF Design Q&A Frequently Asked Questions on the decisions behind the BPF infrastructure
HOWTO interact with BPF subsystem Frequently Asked Questions about contributing to eBPF development

Awesome eBPF / Reference Documentation / Manual Pages
bpf(2) Manual page about the system call, used to manage BPF programs and maps from userspace
tc-bpf(8) Manual page about using BPF with tc, including example commands and samples of code
bpf-helpers(7) man page Description of the in-kernel helper functions forming the BPF standard library

Awesome eBPF / Reference Documentation / Other
bpf.h and you...
Contextually speaking...
BPF Verifier Overview

Awesome eBPF / Articles and Presentations / Generic eBPF Presentations and Articles
Part 1: Introduction
Part 2: Machine & Bytecode
Part 1: Past, Present, and Future
Part 2: Syscall and Map Types
A Tour of Program Types A description of all existing hooks for BPF program types, and of their interest
BPF helper functions A review of the kernel functions that can be called from within eBPF programs
Communicating with Userspace How BPF communicates with userspace - BPF maps, perf events, bpf_trace_printk
Building BPF Programs Setting up your environment to build BPF programs
The BPF Bytecode and the BPF Verifier How does BPF ensure that programs are safe?
Using BPF to do Packet Transformation One eBPF usage about packet transformation

Awesome eBPF / Articles and Presentations / BPF Internals
eBPF and XDP walkthrough and recent (2017) updates
Advanced programmability and recent updates with tc's cls_bpf Details on eBPF, its use for tunneling and encapsulation, direct packet access, and more
cls_bpf/eBPF updates since netdev 1.1 Part of
On getting tc classifier fully programmable with cls_bpf Introduction to eBPF, including several features (map management, tail calls, verifier). The full paper
Linux tc and eBPF

Awesome eBPF / Articles and Presentations / Kernel Tracing
Full-system dynamic tracing on Linux using eBPF and bpftrace A detailed introduction to tracing with eBPF, from listing the available trace points to running bpftrace programs
Meet-cute between eBPF and Kernel Tracing Kprobes, uprobes, ftrace
Linux Kernel Tracing Systemtap, Kernelshark, trace-cmd, LTTng, perf-tool, ftrace, hist-trigger, perf, function tracer, tracepoint, kprobe/uprobe, and more
Linux BPF Superpowers Brendan Gregg's blog, and in particular article

Awesome eBPF / Articles and Presentations / XDP
XDP − eXpress Data Path, Intro and future use-cases Linux Kernel's fight against DPDK. Future plans (as of this writing) for XDP and comparison with DPDK
Network Performance Workshop Additional hints about XDP internals and expected evolution
XDP – eXpress Data Path, Used for DDoS protection Details and use cases about XDP, with benchmark results, and code snippets for benchmarking as well as for basic DDoS protection with eBPF/XDP (based on an IP blacklisting scheme)
Memory vs. Networking, Provoking and fixing memory bottlenecks Advanced details about current memory issues faced by XDP developers
XDP for the Rest of Us How to get started with eBPF and XDP for normal humans. Also summarized by Julia Evans on
XDP now with REDIRECT Update on XDP, and in particular on the redirect actions

Awesome eBPF / Articles and Presentations / AF_XDP
AF_XDP Kernel documentation on the AF_XDP address family
Fast Packet Processing in Linux with AF_XDP

Awesome eBPF / Articles and Presentations / bpfilter
Why is the kernel community replacing iptables with BPF? A blog post by Cilium on the the motivations behind eBPF and bpfilter, with a couple examples and links to other projects using eBPF and bpfilter
bpfilter: Linux firewall with eBPF sauce Slides from a talk by Quentin Monnet with a background on eBPF and comparing bpfilter to iptables

Awesome eBPF / Articles and Presentations / BTF
BPF Type Format (BTF) Kernel documentation about BTF, explaining how to use it
Enhancing the Linux kernel with BTF type information A description of the work done with BTF to provide debugging information for BPF programs

Awesome eBPF / Articles and Presentations / cBPF
The BSD Packet Filter: A New Architecture for User-level Packet Capture The original paper about (classic) BPF
The FreeBSD manual page about BPF
Linux' packet mmap(2), BPF, and Netsniff-NG
tc and cls bpf: lightweight packet classifying with BPF
Introducing Cloudflare's BPF Tools Usage of BPF bytecode with the module for iptables
Libpcap filters syntax

Awesome eBPF / Articles and Presentations / Hardware Offload
eBPF/XDP hardware offload to SmartNICs Hardware offload for eBPF with TC or XDP (Linux kernel 4.9+), introduced by Netronome
Comprehensive XDP offload---Handling the edge cases An update on the topic above
hBPF - eBPF in hardware 402 almost 2 years ago An eBPF CPU written for FPGAs
OpenCSD eBPF SSD offloading 57 about 1 year ago Computational Storage simulation (QEMU) platform with FUSE LFS filesystem for Zoned Namespaces NVMe SSDs using uBPF for compute kernel offloading, all in userspace
Delilah: eBPF-offload on Computational Storage Delilah is a Computational Storage Processor (CSP) built for eBPF offload to storage devices

Awesome eBPF / Tutorials
bcc Reference Guide 20,577 7 days ago Many incremental steps to start using bcc and eBPF, mostly centered on tracing and monitoring
bcc Python Developer Tutorial 20,577 7 days ago Comes with bcc, but targets the Python bits across seventeen "lessons"
Building BPF applications with libbpf-bootstrap Helps generate minimal or advanced templates to bootstrap your own applications (kernel side and user space management for maps and programs) with features like CO-RE, global variables, and ring buffer
How I ended up writing opensnoop in pure C using eBPF A thorough walk-through of how to write eBPF programs, first using only bpf() syscall, and then libbpf library, with reproducible code examples
Linux Tracing Workshops Materials 1,285 over 4 years ago Involves the use of several BPF tools for tracing
Tracing a packet journey using Linux tracepoints, perf and eBPF Troubleshooting ping requests and replies with perf and bcc programs
Open NFP platform Operated by Netronome: some tutorials for network-related eBPF use cases, including an eBPF Offload Starting Guide
XDP for the Rest of Us First edition of a workshop to get started with XDP
XDP for the Rest of Us Second edition, with new contents
Load XDP programs using the ip (iproute2) command
XDP Hands-On Tutorial 2,497 13 days ago A progressive (three levels of difficulty) tutorial to learn how to process packets with XDP
All your tracing are belong to BPF A step-by-step walkthrough to integrate tracing capabilities in your C++ applications with the LLVM libraries
Firewalling with BPF/XDP: Examples and Deep Dive A simple guide to build basic firewalls with TC and XDP
A Deep Dive into eBPF: Writing an Efficient DNS Monitoring. A detailed explanation of methods used to capture DNS requests at the socket filter layer
eBPF Developer Tutorial - Learn eBPF by examples Start with eBPF basics and progress to advanced topics using 20+ hands-on tutorials and examples. Covers performance, networking, and security with libbpf and CO-RE. Available in Chinese and English
Catch Performance Regressions in eBPF A step-by-step guide to benchmarking both the client and kernel eBPF code written in Rust

Awesome eBPF / Examples
linux/samples/bpf/ In the kernel tree: some sample eBPF programs
linux/tools/testing/selftests/bpf In the kernel tree: Linux BPF selftests, with many eBPF programs
prototype-kernel/kernel/samples/bpf 300 3 days ago Jesper Dangaard Brouer's prototype-kernel repository contains some additional examples that can be compiled outside of kernel infrastructure
iproute2/examples/bpf/ Some networking programs to attach to the TC interface
Netronome sample network applications 99 over 4 years ago Provides basic but complete examples of eBPF applications also compatible with hardware offload
bcc/examples 20,577 7 days ago Examples coming along with the bcc tools, mostly about tracing
bcc/tools 20,577 7 days ago These tools themselves can be seen as example use cases for BPF programs, mostly for tracing and monitoring. bcc tools have been packaged for some Linux distributions
MPLSinIP sample 53 about 5 years ago A heavily commented sample demonstrating how to encapsulate & decapsulate MPLS within IP. The code is commented for those new to BPF development
ebpf-samples 91 12 days ago A collection of compiled (as ELF object files) samples gathered from several projects, primarily intended to serve as test cases for user space verifiers
ebpf-kill-example 22 over 1 year ago A fully documented and tested example of an eBPF probe that logs all force-kills and prints them out in user-space
redbpf examples 1,711 over 1 year ago Example programs for using RedBPF to write eBPF programs in Rust
XDP/TC-eBPF example 42 8 days ago Program that uses XDP/TC-eBPF to provide statefull firewalling and socket redirection

Awesome eBPF / eBPF Workflow: Tools and Utilities / bcc
bcc 20,577 7 days ago Framework and set of tools - One way to handle BPF programs, in particular for tracing and monitoring. Also includes some utilities that may help inspect maps or programs on the system
Lua front-end for BCC 20,577 7 days ago Another alternative to C, and even to most of the Python code used in bcc

Awesome eBPF / eBPF Workflow: Tools and Utilities / iproute2
iproute2 Package containing tools for network management on Linux. In particular, it contains , used to manage eBPF filters and actions, and , used to manage XDP programs. Most of the code related to BPF is in lib/bpf.c
iproute2-next The development tree, synchronised with net-next

Awesome eBPF / eBPF Workflow: Tools and Utilities / LLVM
this commit clang is used to compile C to eBPF object file under the ELF format (clang v3.7.1+). The BPF backend was added with

Awesome eBPF / eBPF Workflow: Tools and Utilities / libbpf
libbpf A C library used for handling BPF objects (programs and maps), and manipulating ELF object files containing them. It is shipped with the kernel and
libbpf-bootstrap 1,098 3 days ago Scaffolding for BPF application development with libbpf and BPF CO-RE

Awesome eBPF / eBPF Workflow: Tools and Utilities / Go libraries
cilium/ebpf 6,328 7 days ago Pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel
libbpfgo 734 9 days ago eBPF library for Go, powered by libbpf
gobpf 2,147 about 1 year ago Go bindings for BCC for creating eBPF programs

Awesome eBPF / eBPF Workflow: Tools and Utilities / Aya
aya 3,226 6 days ago A pure Rust library for writing, loading, and managing eBPF objects, with a focus on developer experience and operability. It supports writing eBPF programs in Rust and distributing library code over crates.io to share it between eBPF programs. Aya does not depend on libbpf
aya-template 83 21 days ago Templates for writing BPF applications in Aya that can be used with
Ebpfguard 290 10 months ago Rust library for writing Linux security policies using eBPF

Awesome eBPF / eBPF Workflow: Tools and Utilities / zbpf
zbpf 122 about 1 month ago A pure Zig framework for writing cross platform eBPF programs, powered by libbpf and Zig toolchain

Awesome eBPF / eBPF Workflow: Tools and Utilities / eunomia-bpf
eunomia-bpf 681 3 months ago A compilation framework and runtime library to build, distribute, dynamically load, and run CO-RE eBPF applications in multiple languages and WebAssembly. It supports writing eBPF kernel code only (to build simple CO-RE libbpf eBPF applications), writing the kernel part in both BCC and libbpf styles, and writing userspace in multiple languages in a WASM module and distributing it with simple JSON data or WASM OCI images. The runtime is based on libbpf only and provides CO-RE to BCC-style eBPF programs without depending on the LLVM library

Awesome eBPF / eBPF Workflow: Tools and Utilities / oxidebpf
oxidebpf 116 9 months ago A pure Rust library for managing eBPF programs, designed for security use cases. The featureset is more limited than other libraries but emphasizes stability across a wide range of kernels and backwards-compatible compile-once-run-most-places

Awesome eBPF / eBPF Workflow: Tools and Utilities / bpftool and Other Tools from the Kernel Tree
bpftool A generic utility that can be used to interact with eBPF programs and maps from userspace, for example to show, dump, load, disassemble, pin programs, or to show, create, pin, update, delete maps, or to attach and detach programs to cgroups
bpf_asm A minimal cBPF assembler
bpf_dbg A small debugger for cBPF programs
bpf_jit_disasm A disassembler for both BPF flavors and could be highly useful for JIT debugging

Awesome eBPF / eBPF Workflow: Tools and Utilities / User Space eBPF
uBPF 832 4 days ago Written in C. Contains an interpreter, a JIT compiler for x86_64 architecture, an assembler and a disassembler
A generic implementation 149 over 3 years ago With support for FreeBSD kernel, FreeBSD user space, Linux kernel, Linux user space and macOS user space. Used for the 's
rbpf 943 23 days ago Written in Rust. Interpreter for Linux, macOS and Windows, and JIT-compiler for x86_64 under Linux
PREVAIL 391 4 days ago A user space verifier for eBPF , with support for loops
oster 298 over 1 year ago Written in Go. A tool for tracing execution of Go programs by attaching eBPF to uprobes
wachy A tracing profiler that aims to make eBPF uprobe-based debugging easier to use. This is done by displaying traces in a UI next to the source code and allowing interactive drilldown analysis

Awesome eBPF / eBPF Workflow: Tools and Utilities / eBPF on Other Platforms
eBPF for Windows 2,942 3 days ago This project is a work-in-progress that allows using existing eBPF toolchains and APIs familiar in the Linux ecosystem to be used on top of Windows

Awesome eBPF / eBPF Workflow: Tools and Utilities / Testing in Virtual Environments
A Vagrant setup To easily test XDP. Less useful now that generic XDP (driver-independant, mostly for testing) exists
bcc in a Docker container 44 over 4 years ago
P4 on the Edge P4 with eBPF to create high-performance programmable switches
OvS Orbit episode (#11), called P4 on the Edge Related to the former item. Audio interview of John Fastabend by Ben Pfaff, one of the core maintainers of Open vSwitch
P4, EBPF and Linux TC Offload P4 with some elements related to eBPF hardware offload on Netronome's NFP (Network Flow Processor) architecture
Old documentation for P4 usage with eBPF 20,577 7 days ago From bcc repository; deprecated by the P4_16 backend linked below
P4_16 backend for eBPF 680 7 days ago
Cilium: Networking & Security for Containers with BPF & XDP Also featuring a load balancer use case
Cilium: Networking & Security for Containers with BPF & XDP -
Cilium: Fast IPv6 container Networking with BPF and XDP
Cilium: BPF & XDP for containers
OvS Orbit episode (#4) Interview of Thomas Graf by Ben Pfaff
A generic introduction to Cilium
A podcast interviewing Thomas Graf Ivan Pepelnjak interviewing Thomas, October 2016, on eBPF, P4, XDP and Cilium
Offloading OVS Flow Processing using eBPF
Coupling the Flexibility of OVN with the Efficiency of IOVisor
"eBPF and XDP" section of Suricata documentation
SEPTun-Mark-II 113 over 6 years ago Extreme Performance Tuning guide - Mark II
A blog post introducing the feature
The adventures of a Suricate in eBPF land
eBPF and XDP seen from the eyes of a meerkat
Enabling eBPF data plane with Calico
InKeV: In-Kernel Distributed Network Virtualization for DCN 953 about 2 years ago
DEEP-mon Helps with measuring power consumption for servers and uses eBPF programs for in-kernel aggregation of data
pixie 5,584 8 days ago Observability for Kubernetes using eBPF. Features include protocol tracing, application profiling, and support for distributed bpftrace deployments
SkyWalking Rover 201 7 days ago is an open-source Application Performance Monitoring (APM) platform specially designed for distributed systems with microservices, cloud-native and container-based (Kubernetes) architectures. SkyWalking Rover is an eBPF-based profiler and metrics collector for C, C++, Golang, and Rust applications
parca-agent 551 9 days ago eBPF based always-on continuous profiler for analysis of CPU and memory usage, down to the line number and throughout time
rbperf 119 7 months ago Sampling profiler and tracer for Ruby
Hubble 3,543 6 days ago Network, service and security observability for Kubernetes using eBPF
Caretta 1,792 8 months ago Instant Kubernetes service dependency map generated by eBPF, right to a Grafana instance
DeepFlow 2,972 3 days ago Instant observability for cloud-native and AI applications based on eBPF
Falco A cloud-native runtime security project used as a Kubernetes threat detection engine
Sysmon for Linux 1,746 14 days ago A security monitoring tool. It depends on
Red Canary Linux Agent Red Canary has started to incorporate eBPF to their Linux security sensor
Tracee 3,624 9 days ago A runtime security and forensics tool for Linux which uses eBPF technology to trace the system and applications at runtime, and analyze collected events to detect suspicious behavioral patterns
redcanary-ebpf-sensor 101 5 months ago A set of BPF programs that gather security relevant event data from the Linux kernel. The BPF programs are combined into a single ELF file from which individual probes can be selectively loaded, depending on the running operating system and kernel version
bpflock - Lock Linux machines 136 almost 3 years ago An eBPF driven security tool for locking and auditing Linux machines
Tetragon 3,652 6 days ago Kubernetes-aware, eBPF-based security observability and runtime enforcement
harpoon 90 2 months ago Trace syscalls from user-space functions, by using eBPF
ply A small but flexible open source dynamic tracer for Linux, with features similar to the bcc tools, but with a simpler language inspired by awk and DTrace
bpftrace A tool for tracing with its own high-level tracing language. It is flexible enough to be envisioned as a Linux replacement for DTrace and SystemTap
bpftrace Cheat Sheet Summary and cheat sheet for programming in bpftrace. Contains information about syntax, probe types, variables and functions
kubectl trace 2,054 4 months ago A kubectl plug-in for executing bpftrace programs in a Kubernetes cluster
inspektor-gadget 2,247 5 days ago A collection of eBPF-based tools to debug and inspect Kubernetes resources and applications
bpfd 477 over 3 years ago Framework for running BPF programs with rules on Linux as a daemon. Container aware
BPFd 95 about 3 years ago A distinct BPF daemon, trying to leverage the flexibility of the bcc tools to trace and debug remote targets, and in particular devices running with Android
adeb 319 almost 2 years ago A Linux shell environment for using tracing tools on Android with BPFd
greggd 6 20 days ago System daemon to compile and load eBPF programs into the kernel, and forward program output to socket for metric aggregation
FUSE Considers using eBPF
upf-bpf 196 about 2 months ago An in-kernel solution based on XDP for 5G UPF
redbpf 1,711 over 1 year ago Tooling and framework to write eBPF code in Rust efficiently
ebpf-explorer 81 over 1 year ago A web interface to explore system's maps and programs
ebpfmon 84 5 months ago A TUI (terminal user interface) application for real time monitoring of eBPF programs
bpfman 522 7 days ago An eBPF Manager for Linux and Kubernetes. Includes a built-in program loader that supports program cooperation for XDP and TC programs, as well as deployment of eBPF programs from OCI images
ptcpdump 565 4 days ago A process-aware, eBPF-based tcpdump-like tool

eBPF in Security
Embrace The Red: Offensive BPF! A series of posts around the introduction into BPF with a focus to an offensive setting, and also how its misuse can be detected. Posts include discussions on the rootkit capabilities of eBPF, or on which tracing type is needed for different use cases
eBPF: Block Linux Fileless Payload "Malware" Execution with BPF LSM Blog post about how BPF can help detection and blocking fileless malware
Blackhat 2021: With Friends Like eBPF, Who Needs Enemies? Talk about an eBPF rootkit and how the capabilities of eBPF could be abused. The rootkit was also the object of a talk at Defcon,
ebpfkit 761 over 1 year ago A rootkit that leverages multiple eBPF features to implement offensive security techniques
ebpfkit-monitor 123 over 1 year ago An utility to statically analyze eBPF bytecode or monitor suspicious eBPF activity at runtime. It was specifically designed to detect ebpfkit
Bad BPF 549 5 months ago A collection of malicious eBPF programs that make use of eBPF's ability to read and write user data in between the usermode program and the kernel
TripleCross 1,786 8 months ago A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities

eBPF in Security / The Code
syscall.c Different operations permitted by the system call, such as program loading or map management
core.c BPF interpreter
verifier.c BPF verifier

eBPF in Security / Development and Community
The bpf-next tree BPF patches land in this tree. It is regularly merged into , which is itself merged for each release to Linus' tree
Kernel documentation About contributions to BPF
The netdev mailing list Mailing list for Linux kernel networking stack development. All patches are sent there for review and inclusion
XDP-newbies A mailing list specially dedicated to XDP programming (both for architecture or for asking for help)
IO Visor mailing list BPF is at the heart of the project, and is regularly discussed on the mailing list
@IOVisor Twitter account
The XDP Collaboration Project 265 9 days ago A GitHub repository with notes and ideas regarding the future evolutions of XDP

eBPF in Security / Other Lists of Resources on eBPF
IO Visor's bcc documentation 20,577 7 days ago
IO Visor's bpf-docs repository 953 about 2 years ago
Dive into BPF: A List of Reading Material

Backlinks from these awesome lists:

More related projects: