awesome-ebpf

A gateway to discover all the basics of eBPF, including a listing of the main related projects and of community resources

In-depth documentation about most features and aspects of eBPF

Index for BPF-related documentation coming with the Linux kernel

eBPF specification (somewhat outdated; information should still be valid, but not exhaustive)

Frequently Asked Questions on the decisions behind the BPF infrastructure

Frequently Asked Questions about contributing to eBPF development

Manual page about the system call, used to manage BPF programs and maps from userspace

Manual page about using BPF with tc, including example commands and samples of code

Description of the in-kernel helper functions forming the BPF standard library

A description of all existing hooks for BPF program types, and of their interest

A review of the kernel functions that can be called from within eBPF programs

How BPF communicates with userspace - BPF maps, perf events, bpf_trace_printk

Setting up your environment to build BPF programs

How does BPF ensure that programs are safe?

One eBPF usage about packet transformation

Details on eBPF, its use for tunneling and encapsulation, direct packet access, and more

Part of

Introduction to eBPF, including several features (map management, tail calls, verifier). The full paper

A detailed introduction to tracing with eBPF, from listing the available trace points to running bpftrace programs

Kprobes, uprobes, ftrace

Systemtap, Kernelshark, trace-cmd, LTTng, perf-tool, ftrace, hist-trigger, perf, function tracer, tracepoint, kprobe/uprobe, and more

Brendan Gregg's blog, and in particular article

Linux Kernel's fight against DPDK. Future plans (as of this writing) for XDP and comparison with DPDK

Additional hints about XDP internals and expected evolution

Details and use cases about XDP, with benchmark results, and code snippets for benchmarking as well as for basic DDoS protection with eBPF/XDP (based on an IP blacklisting scheme)

Advanced details about current memory issues faced by XDP developers

How to get started with eBPF and XDP for normal humans. Also summarized by Julia Evans on

Update on XDP, and in particular on the redirect actions

Kernel documentation on the AF_XDP address family

A blog post by Cilium on the the motivations behind eBPF and bpfilter, with a couple examples and links to other projects using eBPF and bpfilter

Slides from a talk by Quentin Monnet with a background on eBPF and comparing bpfilter to iptables

Kernel documentation about BTF, explaining how to use it

A description of the work done with BTF to provide debugging information for BPF programs

A community-authored newsletter enriched with useful code illustrations and hands-on examples

The original paper about (classic) BPF

Usage of BPF bytecode with the module for iptables

Hardware offload for eBPF with TC or XDP (Linux kernel 4.9+), introduced by Netronome

An update on the topic above

hBPF - eBPF in hardware

An eBPF CPU written for FPGAs

OpenCSD eBPF SSD offloading

Computational Storage simulation (QEMU) platform with FUSE LFS filesystem for Zoned Namespaces NVMe SSDs using uBPF for compute kernel offloading, all in userspace

Delilah is a Computational Storage Processor (CSP) built for eBPF offload to storage devices

bcc Reference Guide

Many incremental steps to start using bcc and eBPF, mostly centered on tracing and monitoring

bcc Python Developer Tutorial

Comes with bcc, but targets the Python bits across seventeen "lessons"

Helps generate minimal or advanced templates to bootstrap your own applications (kernel side and user space management for maps and programs) with features like CO-RE, global variables, and ring buffer

A thorough walk-through of how to write eBPF programs, first using only bpf() syscall, and then libbpf library, with reproducible code examples

Linux Tracing Workshops Materials

Involves the use of several BPF tools for tracing

Troubleshooting ping requests and replies with perf and bcc programs

Operated by Netronome: some tutorials for network-related eBPF use cases, including an eBPF Offload Starting Guide

First edition of a workshop to get started with XDP

Second edition, with new contents

XDP Hands-On Tutorial

A progressive (three levels of difficulty) tutorial to learn how to process packets with XDP

A step-by-step walkthrough to integrate tracing capabilities in your C++ applications with the LLVM libraries

A simple guide to build basic firewalls with TC and XDP

A detailed explanation of methods used to capture DNS requests at the socket filter layer

Start with eBPF basics and progress to advanced topics using 20+ hands-on tutorials and examples. Covers performance, networking, and security with libbpf and CO-RE. Available in Chinese and English

A step-by-step guide to benchmarking both the client and kernel eBPF code written in Rust

Newsletter about all the ways to loop and iterate in eBPF

A step-by-step guide how eBPF can observe encrypted network traffic

A step-by-step guide how eBPF can observe Redis communication between client and server

A step-by-step guide on how to implement a transparent proxy using eBPF

Learn how eBPF can infer custom load-balancing for services listening on the same port, through the SO_REUSEPORT TCP option

Learn how you can unit test your eBPF programs using libbpf

Learn how eBPF can speed-up local socket communication up to 30%

In the kernel tree: some sample eBPF programs

In the kernel tree: Linux BPF selftests, with many eBPF programs

prototype-kernel/kernel/samples/bpf

Jesper Dangaard Brouer's prototype-kernel repository contains some additional examples that can be compiled outside of kernel infrastructure

Some networking programs to attach to the TC interface

Netronome sample network applications

Provides basic but complete examples of eBPF applications also compatible with hardware offload

bcc/examples

Examples coming along with the bcc tools, mostly about tracing

bcc/tools

These tools themselves can be seen as example use cases for BPF programs, mostly for tracing and monitoring. bcc tools have been packaged for some Linux distributions

MPLSinIP sample

A heavily commented sample demonstrating how to encapsulate & decapsulate MPLS within IP. The code is commented for those new to BPF development

ebpf-samples

A collection of compiled (as ELF object files) samples gathered from several projects, primarily intended to serve as test cases for user space verifiers

ebpf-kill-example

A fully documented and tested example of an eBPF probe that logs all force-kills and prints them out in user-space

redbpf examples

Example programs for using RedBPF to write eBPF programs in Rust

XDP/TC-eBPF example

Program that uses XDP/TC-eBPF to provide statefull firewalling and socket redirection

bcc

Framework and set of tools - One way to handle BPF programs, in particular for tracing and monitoring. Also includes some utilities that may help inspect maps or programs on the system

Lua front-end for BCC

Another alternative to C, and even to most of the Python code used in bcc

Package containing tools for network management on Linux. In particular, it contains , used to manage eBPF filters and actions, and , used to manage XDP programs. Most of the code related to BPF is in lib/bpf.c

The development tree, synchronised with net-next

clang is used to compile C to eBPF object file under the ELF format (clang v3.7.1+). The BPF backend was added with

A C library used for handling BPF objects (programs and maps), and manipulating ELF object files containing them. It is shipped with the kernel and

libbpf-bootstrap

Scaffolding for BPF application development with libbpf and BPF CO-RE

cilium/ebpf

Pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel

libbpfgo

eBPF library for Go, powered by libbpf

gobpf

Go bindings for BCC for creating eBPF programs

aya

A pure Rust library for writing, loading, and managing eBPF objects, with a focus on developer experience and operability. It supports writing eBPF programs in Rust and distributing library code over crates.io to share it between eBPF programs. Aya does not depend on libbpf

aya-template

Templates for writing BPF applications in Aya that can be used with

Ebpfguard

Rust library for writing Linux security policies using eBPF

zbpf

A pure Zig framework for writing cross platform eBPF programs, powered by libbpf and Zig toolchain

eunomia-bpf

A compilation framework and runtime library to build, distribute, dynamically load, and run CO-RE eBPF applications in multiple languages and WebAssembly. It supports writing eBPF kernel code only (to build simple CO-RE libbpf eBPF applications), writing the kernel part in both BCC and libbpf styles, and writing userspace in multiple languages in a WASM module and distributing it with simple JSON data or WASM OCI images. The runtime is based on libbpf only and provides CO-RE to BCC-style eBPF programs without depending on the LLVM library

oxidebpf

A pure Rust library for managing eBPF programs, designed for security use cases. The featureset is more limited than other libraries but emphasizes stability across a wide range of kernels and backwards-compatible compile-once-run-most-places

A generic utility that can be used to interact with eBPF programs and maps from userspace, for example to show, dump, load, disassemble, pin programs, or to show, create, pin, update, delete maps, or to attach and detach programs to cgroups

A minimal cBPF assembler

A small debugger for cBPF programs

A disassembler for both BPF flavors and could be highly useful for JIT debugging

uBPF

Written in C. Contains an interpreter, a JIT compiler for x86_64 architecture, an assembler and a disassembler

A generic implementation

With support for FreeBSD kernel, FreeBSD user space, Linux kernel, Linux user space and macOS user space. Used for the 's

rbpf

Written in Rust. Interpreter for Linux, macOS and Windows, and JIT-compiler for x86_64 under Linux

PREVAIL

A user space verifier for eBPF , with support for loops

oster

Written in Go. A tool for tracing execution of Go programs by attaching eBPF to uprobes

A tracing profiler that aims to make eBPF uprobe-based debugging easier to use. This is done by displaying traces in a UI next to the source code and allowing interactive drilldown analysis

eBPF for Windows

This project is a work-in-progress that allows using existing eBPF toolchains and APIs familiar in the Linux ecosystem to be used on top of Windows

To easily test XDP. Less useful now that generic XDP (driver-independant, mostly for testing) exists

P4 with eBPF to create high-performance programmable switches

Related to the former item. Audio interview of John Fastabend by Ben Pfaff, one of the core maintainers of Open vSwitch

P4 with some elements related to eBPF hardware offload on Netronome's NFP (Network Flow Processor) architecture

Old documentation for P4 usage with eBPF

From bcc repository; deprecated by the P4_16 backend linked below

Also featuring a load balancer use case

-

Interview of Thomas Graf by Ben Pfaff

Ivan Pepelnjak interviewing Thomas, October 2016, on eBPF, P4, XDP and Cilium

SEPTun-Mark-II

Extreme Performance Tuning guide - Mark II

Helps with measuring power consumption for servers and uses eBPF programs for in-kernel aggregation of data

pixie

Observability for Kubernetes using eBPF. Features include protocol tracing, application profiling, and support for distributed bpftrace deployments

SkyWalking Rover

is an open-source Application Performance Monitoring (APM) platform specially designed for distributed systems with microservices, cloud-native and container-based (Kubernetes) architectures. SkyWalking Rover is an eBPF-based profiler and metrics collector for C, C++, Golang, and Rust applications

parca-agent

eBPF based always-on continuous profiler for analysis of CPU and memory usage, down to the line number and throughout time

rbperf

Sampling profiler and tracer for Ruby

Hubble

Network, service and security observability for Kubernetes using eBPF

Caretta

Instant Kubernetes service dependency map generated by eBPF, right to a Grafana instance

DeepFlow

Instant observability for cloud-native and AI applications based on eBPF

A cloud-native runtime security project used as a Kubernetes threat detection engine

Sysmon for Linux

A security monitoring tool. It depends on

Red Canary has started to incorporate eBPF to their Linux security sensor

Tracee

A runtime security and forensics tool for Linux which uses eBPF technology to trace the system and applications at runtime, and analyze collected events to detect suspicious behavioral patterns

redcanary-ebpf-sensor

A set of BPF programs that gather security relevant event data from the Linux kernel. The BPF programs are combined into a single ELF file from which individual probes can be selectively loaded, depending on the running operating system and kernel version

bpflock - Lock Linux machines

An eBPF driven security tool for locking and auditing Linux machines

Tetragon

Kubernetes-aware, eBPF-based security observability and runtime enforcement

harpoon

Trace syscalls from user-space functions, by using eBPF

A small but flexible open source dynamic tracer for Linux, with features similar to the bcc tools, but with a simpler language inspired by awk and DTrace

A tool for tracing with its own high-level tracing language. It is flexible enough to be envisioned as a Linux replacement for DTrace and SystemTap

Summary and cheat sheet for programming in bpftrace. Contains information about syntax, probe types, variables and functions

kubectl trace

A kubectl plug-in for executing bpftrace programs in a Kubernetes cluster

inspektor-gadget

A collection of eBPF-based tools to debug and inspect Kubernetes resources and applications

bpfd

Framework for running BPF programs with rules on Linux as a daemon. Container aware

BPFd

A distinct BPF daemon, trying to leverage the flexibility of the bcc tools to trace and debug remote targets, and in particular devices running with Android

adeb

A Linux shell environment for using tracing tools on Android with BPFd

greggd

System daemon to compile and load eBPF programs into the kernel, and forward program output to socket for metric aggregation

Considers using eBPF

upf-bpf

An in-kernel solution based on XDP for 5G UPF

redbpf

Tooling and framework to write eBPF code in Rust efficiently

ebpf-explorer

A web interface to explore system's maps and programs

ebpfmon

A TUI (terminal user interface) application for real time monitoring of eBPF programs

bpfman

An eBPF Manager for Linux and Kubernetes. Includes a built-in program loader that supports program cooperation for XDP and TC programs, as well as deployment of eBPF programs from OCI images

ptcpdump

A process-aware, eBPF-based tcpdump-like tool

A series of posts around the introduction into BPF with a focus to an offensive setting, and also how its misuse can be detected. Posts include discussions on the rootkit capabilities of eBPF, or on which tracing type is needed for different use cases

Blog post about how BPF can help detection and blocking fileless malware

Talk about an eBPF rootkit and how the capabilities of eBPF could be abused. The rootkit was also the object of a talk at Defcon,

ebpfkit

A rootkit that leverages multiple eBPF features to implement offensive security techniques

ebpfkit-monitor

An utility to statically analyze eBPF bytecode or monitor suspicious eBPF activity at runtime. It was specifically designed to detect ebpfkit

Bad BPF

A collection of malicious eBPF programs that make use of eBPF's ability to read and write user data in between the usermode program and the kernel

TripleCross

A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities

Different operations permitted by the system call, such as program loading or map management

BPF interpreter

BPF verifier

BPF patches land in this tree. It is regularly merged into , which is itself merged for each release to Linus' tree

About contributions to BPF

Mailing list for Linux kernel networking stack development. All patches are sent there for review and inclusion

A mailing list specially dedicated to XDP programming (both for architecture or for asking for help)

BPF is at the heart of the project, and is regularly discussed on the mailing list

The XDP Collaboration Project

A GitHub repository with notes and ideas regarding the future evolutions of XDP