eBPF
251 items from zoidbergwill/awesome-ebpf ★5,181
-
merbridge github.com
Use eBPF to speed up your Service Mesh. Merbridge replaces iptables rules with eBPF to intercept traffic. It also combines msg_redirect to reduce latency with a shortened datapath between sidecars and services.
-
bpfman github.com
An eBPF Manager for Linux and Kubernetes. Includes a built-in program loader that supports program cooperation for XDP and TC programs, as well as deployment of eBPF programs from OCI images.
-
parca-agent github.com
eBPF based always-on continuous profiler for analysis of CPU and memory usage, down to the line number and throughout time.
-
AgentSight github.com
Zero-instrumentation eBPF observability for LLM and coding agents, capturing syscall-level traces (file, network, process) without modifying the agent.
-
Bad BPF github.com
A collection of malicious eBPF programs that make use of eBPF's ability to read and write user data in between the usermode program and the kernel.
-
SEPTun-Mark-II github.com
Extreme Performance Tuning guide - Mark II.
-
bpfd github.com
Framework for running BPF programs with rules on Linux as a daemon. Container aware.
-
PREVAIL github.com
A user space verifier for eBPF using an abstract interpretation layer, with support for loops.
-
hBPF - eBPF in hardware github.com
An eBPF CPU written for FPGAs.
-
Gthulhu github.com
Gthulhu optimizes cloud-native workloads using the Linux Scheduler Extension for different application scenarios.
-
adeb github.com
A Linux shell environment for using tracing tools on Android with BPFd.
-
The XDP Collaboration Project github.com
A GitHub repository with notes and ideas regarding the future evolutions of XDP.
-
zbpf github.com
A pure Zig framework for writing cross platform eBPF programs, powered by libbpf and Zig toolchain.
-
owLSM github.com
Open source agent that implements a stateful Sigma rules engine focused on monitoring and prevention using eBPF LSM.
-
SkyWalking Rover github.com
Apache SkyWalking is an open-source Application Performance Monitoring (APM) platform specially designed for distributed systems with microservices, cloud-native and container-based (Kubernetes) architectures. SkyWalking Rover is an eBPF-based profiler and metrics collector for…
-
upf-bpf github.com
An in-kernel solution based on XDP for 5G UPF.
-
GhostScope github.com
A DWARF-aware eBPF tracer for source-level userspace tracing, with an interactive TUI and a scriptable CLI.
-
harpoon github.com
Trace syscalls from user-space functions, by using eBPF.
-
bpflock - Lock Linux machines github.com
An eBPF driven security tool for locking and auditing Linux machines.
-
A generic implementation github.com
With support for FreeBSD kernel, FreeBSD user space, Linux kernel, Linux user space and macOS user space. Used for the VALE software switch's BPF extension module.
-
The eXpress Data Path: Fast Programmable Packet Processing in the Operating System Kernel github.com
, by Toke Høiland-Jørgensen, Jesper Dangaard Brouer, Daniel Borkmann, John Fastabend, Tom Herbert, David Ahern and David Miller, all being essential eBPF and XDP contributors.
-
ebpfkit-monitor github.com
An utility to statically analyze eBPF bytecode or monitor suspicious eBPF activity at runtime. It was specifically designed to detect ebpfkit.
-
aya-template github.com
Templates for writing BPF applications in Aya that can be used with cargo generate.
-
rbperf github.com
Sampling profiler and tracer for Ruby.
-
redcanary-ebpf-sensor github.com
A set of BPF programs that gather security relevant event data from the Linux kernel. The BPF programs are combined into a single ELF file from which individual probes can be selectively loaded, depending on the running operating system and kernel version.
-
Netronome sample network applications github.com
Provides basic but complete examples of eBPF applications also compatible with hardware offload.
-
ActPlane github.com
OS-level agent harness that compiles a policy DSL to an in-kernel eBPF engine for labeled information-flow control at the syscall boundary, enforcing constraints across any tool or subprocess.
-
BPFd github.com
A distinct BPF daemon, trying to leverage the flexibility of the bcc tools to trace and debug remote targets, and in particular devices running with Android.
-
ebpf-samples github.com
A collection of compiled (as ELF object files) samples gathered from several projects, primarily intended to serve as test cases for user space verifiers.
-
ebpf-explorer github.com
A web interface to explore system's maps and programs.
-
ebpfmon github.com
A TUI (terminal user interface) application for real time monitoring of eBPF programs.
-
XDP/TC-eBPF example github.com
Program that uses XDP/TC-eBPF to provide statefull firewalling and socket redirection.
-
Bombini github.com
An eBPF-based security agent written entirely in Rust using the Aya library and built on LSM (Linux Security Module) BPF hooks.
-
OpenCSD eBPF SSD offloading github.com
Computational Storage simulation (QEMU) platform with FUSE LFS filesystem for Zoned Namespaces NVMe SSDs using uBPF for compute kernel offloading, all in userspace.
-
BPFJailer github.com
BpfJailer is an eBPF-based process jailing system that provides mandatory access control (MAC) for Linux.
-
MPLSinIP sample github.com
A heavily commented sample demonstrating how to encapsulate and decapsulate MPLS within IP. The code is commented for those new to BPF development.
-
bcc in a Docker container github.com
-
ebpf-kill-example github.com
A fully documented and tested example of an eBPF probe that logs all force-kills and prints them out in user-space.
-
bpfcompat github.com
Boots real Linux kernels in disposable QEMU/KVM VMs to load- and attach-validate compiled eBPF objects across a multi-distro, multi-architecture kernel matrix, classifying failures (missing BTF, unsupported map/program type, CO-RE relocations); runs as a CI gate and GitHub…
-
kpod-metrics github.com
eBPF-based pod-level kernel metrics collector for Kubernetes. Exports per-pod CPU, network, memory, syscall, disk I/O, and L7 protocol metrics to Prometheus. BPF programs are defined using a Kotlin DSL instead of C.
-
ipx_wrap github.com
A proof-of-concept IPX implementation for Linux using eBPF.
-
greggd github.com
System daemon to compile and load eBPF programs into the kernel, and forward program output to socket for metric aggregation.
-
eTraceGen github.com
eTraceGen is a Linux telemetry engine built with eBPF and Modern C++ that captures kernel-level events for processes, files, system calls, and network with a modular pipeline for decoding, enrichment, filtering, and JSON output.
-
rstat github.com
Sub-millisecond system monitoring using eBPF tracepoints on sched_switch, sched_process_exit, and sched_process_free, with zero heap allocations in steady state.
-
Inner Warden github.com
A self-defending security agent for Linux and macOS that uses eBPF with 22 kernel hooks (tracepoints, kprobes, LSM, XDP) via the Aya library for real-time threat detection, automated response, and AI-powered triage.
-
Synapse github.com
Extended detection and response (XDR) with eBPF-powered firewall and proxy, to protect your Linux servers.
-
Ingero github.com
eBPF-based GPU causal observability agent. Traces CUDA Runtime and Driver APIs via uprobes and host kernel events via tracepoints to build causal chains explaining GPU latency, with <2% overhead.
