BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
Repository Index
47,133 repositories indexed
1–24 of 46 · Most stars
Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64\arm64 and loong64.
Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.
- reverse-engineering
- disassembler
- security
- framework
eBPF-based Security Observability and Runtime Enforcement
Kyanos is a networking analysis tool using eBPF. It can visualize the time packets spend in the kernel, capture requests/responses, makes troubleshooting more efficient.
Packet, where are you? -- eBPF-based Linux kernel networking debugger
eBPF implementation that runs on top of Windows
the LIBpcap interface to various kernel packet capture mechanism
- pcap
- pcapng
- packet-capture
- sniffer
XDP tutorial
High-speed packet processing framework
- pf-ring
- capture-packets
- high-speed
- 100gbit
Automated upstream mirror for libbpf stand-alone build.
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
Learning eBPF, published by O'Reilly - out now! Here's where you'll find a VM config for the examples, and more
- ebpf
- ebpf-co-re
- linux-kernel
Process-aware, eBPF-based tcpdump
- ebpf
- ebpf-tc
- tcpdump
- tcpdump-like
pmacct is a small set of multi-purpose passive network monitoring tools [NetFlow IPFIX sFlow libpcap BGP BMP RPKI IGP Streaming Telemetry].
- netflow
- ipfix
- sflow
- bgp
ngrep is like GNU grep applied to the network layer. It's a PCAP-based tool that allows you to specify an extended regular or hexadecimal expression to match against data payloads of packets. It understands many kinds of protocols, including IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw, across a wide variety of interface types, and understands BPF filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop.
- sniffer
- grepping
Userspace eBPF VM
A portable framework for low-level network packet construction
- network-packets
- ospf
- rip
- bgp
Translatedapfree-wifidog is a high-performance captive portal solution that serves as a gateway between your wireless networks and the Internet. Optimized for both HTTP and HTTPS traffic, it ensures secure border control while enabling seamless user authentication and efficient network management. Buy the services in the link below to support my open source work.
- openwrt
- libevent
- c
- wifidog
Netflow processing tools
- nfdump
- ipfix
- nfsen
- netflow
ebpfkit is a rootkit powered by eBPF
lightweight system-level observability for AI Agents
A collection of eBPF programs demonstrating bad behavior, presented at DEF CON 29
Alaz: Advanced eBPF Agent for Kubernetes Observability – Effortlessly monitor K8s service interactions and performance metrics in your K8s environment. Gain in-depth insights with service maps, metrics, and more, while staying alert to crucial system anomalies 🐝
- ddosify
- ebpf
- kubernetes
- metrics