eBPF-based Networking, Security, and Observability
Repository Index
47,133 repositories indexed
1–24 of 72 · Most stars
APM, Application Performance Monitoring System
The container platform tailored for Kubernetes multi-cloud, datacenter, and edge management ⎈ 🖥 ☁️
Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64 and arm64.
eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.
High-level tracing language for Linux
Cloud Native Runtime Security
ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.
Coroot is an open-source observability and APM tool with AI-powered Root Cause Analysis. It combines metrics, logs, traces, continuous profiling, and SLO-based alerting with predefined dashboards and inspections.
Instant Kubernetes-Native Application Observability
A curated list of awesome projects related to eBPF.
eBPF-based Security Observability and Runtime Enforcement
Kyanos is a networking analysis tool using eBPF. It can visualize the time packets spend in the kernel, capture requests/responses, makes troubleshooting more efficient.
Aya is an eBPF library for the Rust programming language, built with a focus on developer experience and operability.
Linux Runtime Security and Forensics using eBPF
Hubble - Network, Service & Security Observability for Kubernetes using eBPF
Packet, where are you? -- eBPF-based Linux kernel networking debugger
PcapPlusPlus is a multiplatform C++ library for capturing, parsing and crafting of network packets. It is designed to be efficient, powerful and easy to use. It provides C++ wrappers for the most popular packet processing engines such as libpcap, Npcap, WinPcap, DPDK, AF_XDP, WinDivert and PF_RING.
🕵️♂️ TUI for sniffing network traffic using eBPF on Linux
Schedule bpftrace programs on your kubernetes cluster using the kubectl
Instant K8s service dependency map, right to your Grafana.
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
Learning eBPF, published by O'Reilly - out now! Here's where you'll find a VM config for the examples, and more
Process-aware, eBPF-based tcpdump