Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64 and arm64.
Repository Index
47,133 repositories indexed
1–23 of 23 · Most stars
eBPF-based Security Observability and Runtime Enforcement
Kyanos is a networking analysis tool using eBPF. It can visualize the time packets spend in the kernel, capture requests/responses, makes troubleshooting more efficient.
Packet, where are you? -- eBPF-based Linux kernel networking debugger
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
Learning eBPF, published by O'Reilly - out now! Here's where you'll find a VM config for the examples, and more
Process-aware, eBPF-based tcpdump
ebpfkit is a rootkit powered by eBPF
lightweight system-level observability for AI Agents
Alaz: Advanced eBPF Agent for Kubernetes Observability – Effortlessly monitor K8s service interactions and performance metrics in your K8s environment. Gain in-depth insights with service maps, metrics, and more, while staying alert to crucial system anomalies 🐝
LordOS — a free, fast and secure GNU/Linux distribution based on Debian, with its own desktop environment: display server and Wayland compositor in C, a React UI engine on QuickJS, and private native apps.
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities
🔍 Function-level tracing tool for Seccomp profiling, with eBPF
bpflock - eBPF driven security for locking and auditing Linux machines
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
Red Canary's eBPF Sensor
eBPF Information Flow Enforcement for AI Agent safety, security and effectiveness
Sample ebpf programs to analyze
An EBPF based IPv4/IPv6 firewall with integrations for OpenZiti Zero-Trust Framework edge-routers and tunnellers
Jailer is an eBPF-based process jailing system that provides mandatory access control (MAC) for Linux. It tracks processes using BPF task_storage maps and enforces role-based policies on file access, network operations, and process execution.
Sample project demonstrating how to use eBPF to encap/decap packets with an MPLS label.
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.
eBPF-based pod-level kernel metrics collector for Kubernetes