eBPF
251 items from zoidbergwill/awesome-ebpf ★5,181
-
eTraceGen github.com
eTraceGen is a Linux telemetry engine built with eBPF and Modern C++ that captures kernel-level events for processes, files, system calls, and network with a modular pipeline for decoding, enrichment, filtering, and JSON output.
-
rstat github.com
Sub-millisecond system monitoring using eBPF tracepoints on sched_switch, sched_process_exit, and sched_process_free, with zero heap allocations in steady state.
-
Dive into BPF: A List of Reading Material qmonnet.github.io
-
IO Visor's bcc documentation github.com
-
The netdev mailing list lists.openwall.net
Mailing list for Linux kernel networking stack development. All patches are sent there for review and inclusion.
-
Kernel documentation git.kernel.org
About contributions to BPF.
-
The bpf-next tree git.kernel.org
BPF patches land in this tree. It is regularly merged into net-next, which is itself merged for each release to Linus' tree.
-
linux/net/core/dev.c git.kernel.org
contains the function dev_change_xdp_fd() that is called through a Netlink command to hook a XDP program to a device, after is has been loaded into the kernel from user space. This function in turns uses a callback from the relevant driver.
-
linux/kernel/seccomp.c git.kernel.org
-
linux/net/sched/ git.kernel.org
and in particular in files act_bpf.c (action) and cls_bpf.c (filter): code related to BPF actions and filters with TC.
-
linux/arch/x86/net/bpf_jit_comp.c git.kernel.org
for x86. Exception is made for JIT compilers used for hardware offload, sitting in their drivers, such as linux/drivers/net/ethernet/netronome/nfp/bpf/jit.c for Netronome NFP.
-
linux/kernel/trace/bpf_trace.c git.kernel.org
Functions and eBPF helpers related to tracing and monitoring (kprobes, tracepoints, etc.).
-
linux/net/core/filter.c git.kernel.org
Functions and eBPF helpers related to networking (TC, XDP etc.); also contains the code to migrate cBPF bytecode to eBPF (all cBPF programs are translated to eBPF in recent kernels).
-
verifier.c git.kernel.org
BPF verifier.
-
core.c git.kernel.org
BPF interpreter.
-
syscall.c git.kernel.org
Different operations permitted by the system call, such as program loading or map management.
-
linux/kernel/bpf/ git.kernel.org
This directory contains most of BPF-related code. In particular, those files are worth of interest:
-
linux/include/linux/filter.h git.kernel.org
with linux/include/uapi/filter.h: information used to run the BPF programs themselves.
-
linux/include/linux/bpf.h git.kernel.org
with linux/include/uapi/bpf.h: definitions related to eBPF, to be used respectively in the kernel and to interface with userspace programs.
-
Blackhat 2021: With Friends Like eBPF, Who Needs Enemies? blackhat.com
Talk about an eBPF rootkit and how the capabilities of eBPF could be abused. The rootkit was also the object of a talk at Defcon, eBPF, I thought we were friends !.
-
eBPF: Block Linux Fileless Payload "Malware" Execution with BPF LSM djalal.opendz.org
Blog post about how BPF can help detection and blocking fileless malware.
-
Embrace The Red: Offensive BPF! embracethered.com
A series of posts around the introduction into BPF with a focus to an offensive setting, and also how its misuse can be detected. Posts include discussions on the rootkit capabilities of eBPF, or on which tracing type is needed for different use cases.
-
FUSE events.linuxfoundation.org
Considers using eBPF.
-
inspektor-gadget inspektor-gadget.io
A collection tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF.
-
bpftrace Cheat Sheet brendangregg.com
Summary and cheat sheet for programming in bpftrace. Contains information about syntax, probe types, variables and functions.
-
bpftrace bpftrace.org
A tool for tracing with its own high-level tracing language. It is flexible enough to be envisioned as a Linux replacement for DTrace and SystemTap.
-
ply wkz.github.io
A small but flexible open source dynamic tracer for Linux, with features similar to the bcc tools, but with a simpler language inspired by awk and DTrace.
-
Inner Warden github.com
A self-defending security agent for Linux and macOS that uses eBPF with 22 kernel hooks (tracepoints, kprobes, LSM, XDP) via the Aya library for real-time threat detection, automated response, and AI-powered triage.
-
Synapse github.com
Extended detection and response (XDR) with eBPF-powered firewall and proxy, to protect your Linux servers.
-
Red Canary Linux Agent redcanary.com
Red Canary has started to incorporate eBPF to their Linux security sensor.
-
Ingero github.com
eBPF-based GPU causal observability agent. Traces CUDA Runtime and Driver APIs via uprobes and host kernel events via tracepoints to build causal chains explaining GPU latency, with <2% overhead.
-
DEEP-mon slideshare.net
Helps with measuring power consumption for servers and uses eBPF programs for in-kernel aggregation of data.
-
-
PcapPlusPlus pcapplusplus.github.io
An open-source C++ library for capturing, parsing and crafting network packets. It features a C++ interface for creating AF_XDP sockets, making it easy to send and receive packets through them.
-
Enabling eBPF data plane with Calico projectcalico.docs.tigera.io
-
Project Calico projectcalico.docs.tigera.io
Calico is an open source networking and network security solution for containers, virtual machines, and native host-based workloads. Calico's eBPF data plane delivers a low latency, high throughput data plane with a rich network security policy model.
-
eBPF and XDP seen from the eyes of a meerkat slideshare.net
-
The adventures of a Suricate in eBPF land netdevconf.org
-
A blog post introducing the "capture bypass" feature stamus-networks.com
-
"eBPF and XDP" section of Suricata documentation suricata.readthedocs.io
-
CETH for XDP slideshare.net
Common Ethernet Driver Framework for faster network I/O, a technology initiated by Mellanox.
-
DPDK has a poll-mode driver (PMD) based on AF_XDP dpdkuserspace2018.sched.com
-
Droplet: DDoS countermeasures powered by BPF + XDP netdevconf.org
Protection against DDoS with XDP at Facebook.
-
XDP in practice: integrating XDP in our DDoS mitigation pipeline netdevconf.org
Protection against DDoS with XDP at Cloudflare.
-
Katran code.fb.com
A layer 4 load-balancer based on XDP, open-sourced by Facebook.
-
A podcast interviewing Thomas Graf blog.ipspace.net
Ivan Pepelnjak interviewing Thomas, October 2016, on eBPF, P4, XDP and Cilium.
-
OvS Orbit episode (#4) ovsorbit.benpfaff.org
Interview of Thomas Graf by Ben Pfaff.
-
Cilium: Fast IPv6 container Networking with BPF and XDP slideshare.net
-
Cilium: Networking & Security for Containers with BPF & XDP slideshare.net
video
-
Cilium: Networking & Security for Containers with BPF & XDP slideshare.net
Also featuring a load balancer use case
- next page of items loading…
