A collection of eBPF programs demonstrating bad behavior, presented at DEF CON 29
Repository Index
47,133 repositories indexed
49–72 of 102 · Most stars
Alaz: Advanced eBPF Agent for Kubernetes Observability – Effortlessly monitor K8s service interactions and performance metrics in your K8s environment. Gain in-depth insights with service maps, metrics, and more, while staying alert to crucial system anomalies 🐝
- ddosify
- ebpf
- kubernetes
- metrics
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
Framework for running BPF programs with rules on Linux as a daemon. Container aware.
eBPF verifier based on abstract interpretation
- abstract-interpretation
- static-analyzer
- ebpf
- ebpf-verifier
hBPF = eBPF in hardware
eBPF-based workload orchestration platform, built for Cloud Native ecosystem.
LordOS — a free, fast and secure GNU/Linux distribution based on Debian, with its own desktop environment: display server and Wayland compositor in C, a React UI engine on QuickJS, and private native apps.
OCI hook to trace syscalls and generate a seccomp profile
- syscalls
- bcc
- seccomp-profile
- containers
Prototyping kernel development work outside mainline
- kernel-modules
- kernel
- xdp
- ebpf-programs
XDP project collaboration through a git-repo
TranslatedPacket monster (っ‘-’)╮=͟͟͞͞◒ ヽ( '-'ヽ) TUI tool for sending packets of arbitrary input and monitoring packets on any network interfaces (default: eth0). Windows/macOS/Linux
- packet-generator
- packet-analyzer
- network
- networking
Performance visualisation tools
- performance
- monitoring
- observability
- ebpf
The Linux port of the Sysinternals Sysmon tool.
Writing eBPF in Zig
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities
- ebpf
- security
- linux-kernel
- linux-security-module
eBPF based TCP observability.
Monitor and profiler powered by eBPF to monitor network traffic, and diagnose CPU and network performance.
- skywalking
- observability
- apm
- service-mesh
An In-Kernel Solution Based on eBPF / XDP for 5G UPF
- 5g-core-network
- upf
- 5gc
- 5g-core
Envoy with Cilium filters
- cilium
- ebpf
DWARF-aware eBPF tracer for source-level userspace tracing - Explore in a TUI or automate with a scriptable CLI
🔍 Function-level tracing tool for Seccomp profiling, with eBPF
- ebpf
- ebpf-programs
- golang
- seccomp
bpflock - eBPF driven security for locking and auditing Linux machines
Generic eBPF runtime