BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
Repository Index
47,133 repositories indexed
1–24 of 40 · Most stars
Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64\arm64 and loong64.
Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.
- reverse-engineering
- disassembler
- security
- framework
eBPF-based Security Observability and Runtime Enforcement
Kyanos is a networking analysis tool using eBPF. It can visualize the time packets spend in the kernel, capture requests/responses, makes troubleshooting more efficient.
Packet, where are you? -- eBPF-based Linux kernel networking debugger
eBPF implementation that runs on top of Windows
the LIBpcap interface to various kernel packet capture mechanism
- pcap
- pcapng
- packet-capture
- sniffer
XDP tutorial
Automated upstream mirror for libbpf stand-alone build.
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
Learning eBPF, published by O'Reilly - out now! Here's where you'll find a VM config for the examples, and more
- ebpf
- ebpf-co-re
- linux-kernel
Process-aware, eBPF-based tcpdump
- ebpf
- ebpf-tc
- tcpdump
- tcpdump-like
ngrep is like GNU grep applied to the network layer. It's a PCAP-based tool that allows you to specify an extended regular or hexadecimal expression to match against data payloads of packets. It understands many kinds of protocols, including IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw, across a wide variety of interface types, and understands BPF filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop.
- sniffer
- grepping
Userspace eBPF VM
ebpfkit is a rootkit powered by eBPF
lightweight system-level observability for AI Agents
A collection of eBPF programs demonstrating bad behavior, presented at DEF CON 29
Alaz: Advanced eBPF Agent for Kubernetes Observability – Effortlessly monitor K8s service interactions and performance metrics in your K8s environment. Gain in-depth insights with service maps, metrics, and more, while staying alert to crucial system anomalies 🐝
- ddosify
- ebpf
- kubernetes
- metrics
LordOS — a free, fast and secure GNU/Linux distribution based on Debian, with its own desktop environment: display server and Wayland compositor in C, a React UI engine on QuickJS, and private native apps.
Prototyping kernel development work outside mainline
- kernel-modules
- kernel
- xdp
- ebpf-programs
The Linux port of the Sysinternals Sysmon tool.
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities
- ebpf
- security
- linux-kernel
- linux-security-module
🔍 Function-level tracing tool for Seccomp profiling, with eBPF
- ebpf
- ebpf-programs
- golang
- seccomp