Repository Index

eBPF-based Networking, Security, and Observability

• containers
• bpf
• security
• kubernetes

Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64\arm64 and loong64.

• golang
• ebpf
• tls
• ssl

eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.

• kubernetes
• golang
• rest
• grpc

High-level tracing language for Linux

• bpf
• ebpf
• tracing
• kprobes

ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.

• ebpf
• linux
• go
• golang

Instant Kubernetes-Native Application Observability

• golang
• kubernetes
• ebpf
• vega

A curated list of awesome projects related to eBPF.

• awesome-list
• awesome
• bpf
• ebpf

eBPF-based Security Observability and Runtime Enforcement

• bpf
• ebpf
• kernel
• kubernetes

Kyanos is a networking analysis tool using eBPF. It can visualize the time packets spend in the kernel, capture requests/responses, makes troubleshooting more efficient.

• command-line-tool
• ebpf
• network
• bpf

Aya is an eBPF library for the Rust programming language, built with a focus on developer experience and operability.

• ebpf
• bpf
• rust
• observability

Linux Runtime Security and Forensics using eBPF

• ebpf
• linux
• bpf
• security

Hubble - Network, Service & Security Observability for Kubernetes using eBPF

• ebpf
• observability
• kubernetes
• metrics

eBPF Observability - Distributed Tracing and Profiling

• opentelemetry
• kubernetes
• wasm
• apm

Packet, where are you? -- eBPF-based Linux kernel networking debugger

• linux
• network
• ebpf
• bpf

eBPF implementation that runs on top of Windows

PcapPlusPlus is a multiplatform C++ library for capturing, parsing and crafting of network packets. It is designed to be efficient, powerful and easy to use. It provides C++ wrappers for the most popular packet processing engines such as libpcap, Npcap, WinPcap, DPDK, AF_XDP, WinDivert and PF_RING.

• pf-ring
• dpdk
• packet-parsing
• winpcap

🕵️‍♂️ TUI for sniffing network traffic using eBPF on Linux

• ebpf
• linux
• ratatui
• rust

Schedule bpftrace programs on your kubernetes cluster using the kubectl

• kubectl
• kubernetes-cluster
• kubectl-trace
• bpf

Instant K8s service dependency map, right to your Grafana.

• ebpf
• kubernetes
• observability

A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.

• backdoor
• ebpf
• kernel
• rootkit

Learning eBPF, published by O'Reilly - out now! Here's where you'll find a VM config for the examples, and more

• ebpf
• ebpf-co-re
• linux-kernel

The beginner's guide to eBPF

Process-aware, eBPF-based tcpdump

• ebpf
• ebpf-tc
• tcpdump
• tcpdump-like

Rust virtual machine and JIT compiler for eBPF programs

• jit-compiler
• ebpf
• ebpf-programs
• rust