Most net stars, last 30 days
cilium/ciliumeBPF-based Networking, Security, and Observability
+185
18% of the net stars of this Tag
Tags / Operating systems and systems /
eBPF tool
Tool or library that uses eBPF programs in the kernel for tracing, networking, or security.
The 31repositories with this Tag gained +1,032 net stars in the last 30 days, 21% less than the 30 days before.
1 created in the last 90 days · 14 published a release in the last 30 days · 158K stars in total
Oct 5, 2026Nov 3, 2026
- Seed Dataset
- Rising Admissions
Largest Pace, last 30 days
No other repository gained 2 or more times the net stars of the 30 days before.
Most stars, created in the last 90 days
Neo23x0/process-watcherA process monitoring tool that tries to detect exploitation
114
stars in total · created 18 days ago
Where the stars went, last 13 weeks
Net stars gained each week. The repositories that gained the most have their own color.
cilium/cilium gained 28% of the net stars of this Tag in the last 13 weeks.
- cilium/cilium28%
- cilium/tetragon8%
- eunomia-bpf/agentsight6%
- gojue/ecapture5%
- aya-rs/aya5%
- All other repositories48%
Compare growth
10 of 31 repositories: The newest GitHub release is more than 180 days old. A repository that never published a release is not in this list. Select a column name to change the order.
| # | Repository | Stars | Gained, 30 days | Pace | |
|---|---|---|---|---|---|
| 1 | aquasecurity/tracee Linux Runtime Security and Forensics using eBPF | 4.7K | +33 | – | |
| 2 | pythops/oryx 🕵️♂️ TUI for sniffing network traffic using eBPF on Linux | 2.6K | +26 | – | |
| 3 | h3xduck/TripleCross A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities. | 2K | +11 | – | |
| 4 | foniod/redbpfarchived Rust library for building and running BPF/eBPF modules | 1.7K | -1 | – | |
| 5 | mozillazg/ptcpdump Process-aware, eBPF-based tcpdump | 1.3K | +17 | – | |
| 6 | eunomia-bpf/eunomia-bpf A Tool to make Build and Run eBPF programs easier | 908 | +3 | – | |
| 7 | merbridge/merbridge Use eBPF to speed up your Service Mesh like crossing an Einstein-Rosen Bridge. | 807 | 0 | – | |
| 8 | bpfman/bpfman An eBPF Manager for Linux and Kubernetes | 772 | +4 | – | |
| 9 | pathtofile/bad-bpf A collection of eBPF programs demonstrating bad behavior, presented at DEF CON 29 | 711 | +12 | – | |
| 10 | getanteon/alaz Alaz: Advanced eBPF Agent for Kubernetes Observability – Effortlessly monitor K8s service interactions and performance metrics in your K8s environment. Gain in-depth insights with service maps, metrics, and more, while staying alert to crucial system anomalies 🐝 | 710 | 0 | – |
Faster than the 30 days before
Net stars of the last 30 days are 2 or more times those of the 30 days before.
No repository with this Tag meets this rule now.
Slower than the 30 days before
Net stars of the last 30 days are 50% or less of those of the 30 days before.
- cilium/cilium0.3× · +185
New in the last 90 days
Created on GitHub in the last 90 days.
- Neo23x0/process-watcher+114 · 18 days ago
Older than 2 years, still releasing
Created more than 2 years ago, with a push in the last 7 days and a GitHub release in the last 30 days.
- cilium/cilium26K · release yesterday
- gojue/ecapture16K · release 4 days ago
- kubeshark/kubeshark12K · release 14 days ago
- bpftrace/bpftrace10K · release 11 days ago
- cilium/tetragon5.2K · release 5 days ago
Last release more than 180 days ago
The newest GitHub release is more than 180 days old. A repository that never published a release is not in this list.
- aquasecurity/tracee4.7K · release 11 months ago
- pythops/oryx2.6K · release 9 months ago
- h3xduck/TripleCross2K · release 4 years ago
- foniod/redbpf1.7K · release 4 years ago
- mozillazg/ptcpdump1.3K · release 11 months ago
Top GitHub topics with this Tag
Primary languages
How a repository gets this Tag
An agent reads the description, the GitHub topics, and the start of the README of each repository. It chooses Tags only from the Tag list in the AwesomeRepos source code. For each Tag, it quotes the text. A code check keeps the Tag only when the quote is in that text. The page of each repository shows the quote of each of its Tags. A Tag does not rank repositories. It does not say that one repository can replace another. To report a wrong Tag, use "Report a problem with this page" on the page of the repository.
How the numbers are counted
All numbers come from the Star History of the repositories that have the Tag now. A period is a run of complete UTC days. All numbers on this page count only the repositories that AwesomeRepos shows in lists. A machine computes them each hour.
For each repository, a period counts only when Star History has each of its days, or when the repository was created in the period. Otherwise the table shows "–". The bars of a week with no complete data are grey.
The Pace is the net stars of a period divided by the net stars of the period before. It shows only when Star History covers each day of the period before, with at least 3 net stars a day on average.
The chart at the top adds up the net stars of all the repositories with the Tag. The darker area is the part from the Seed Dataset; the rest is from rising Admissions. A rising Admission comes into the Repository Index because it gained stars quickly. Its Star History before its Admission comes from the Repository Host. Thus the days before many rising Admissions are higher than they were for the repositories in the index at that time. The repositories of the Seed Dataset are a set that does not change.
The releases are the GitHub releases of each repository. The lists and the table do not rank repositories, and they do not say that one repository can replace another.