AwesomeRepos
Sign in

Tags / Operating systems and systems /

eBPF tool

Tool or library that uses eBPF programs in the kernel for tracing, networking, or security.

The 54repositories with this Tag gained +1,063 net stars in the last 30 days, 21% less than the 30 days before.

1 created in the last 90 days · 15 published a release in the last 30 days · 163K stars in total

All in the Repository Index On Trending

Net stars each day, last 30 days+227 last 7 days

Oct 6, 2026Nov 4, 2026

Most net stars, last 30 days

cilium/cilium

eBPF-based Networking, Security, and Observability

+184

17% of the net stars of this Tag

Largest Pace, last 30 days

No other repository gained 2 or more times the net stars of the 30 days before.

Most stars, created in the last 90 days

Neo23x0/process-watcher

A process monitoring tool that tries to detect exploitation

114

stars in total · created 19 days ago

Where the stars went, last 13 weeks

Net stars gained each week. The repositories that gained the most have their own color.

cilium/cilium gained 27% of the net stars of this Tag in the last 13 weeks.

cilium/cilium, week to Aug 12: +60 net starscilium/tetragon, week to Aug 12: +25 net starseunomia-bpf/agentsight, week to Aug 12: +18 net starsaya-rs/aya, week to Aug 12: +14 net starsgojue/ecapture, week to Aug 12: +22 net starsAll other repositories, week to Aug 12: +152 net starscilium/cilium, week to Aug 19: +65 net starscilium/tetragon, week to Aug 19: +21 net starseunomia-bpf/agentsight, week to Aug 19: +14 net starsaya-rs/aya, week to Aug 19: +17 net starsgojue/ecapture, week to Aug 19: +12 net starsAll other repositories, week to Aug 19: +164 net starscilium/cilium, week to Aug 26: +41 net starscilium/tetragon, week to Aug 26: +19 net starseunomia-bpf/agentsight, week to Aug 26: +13 net starsaya-rs/aya, week to Aug 26: +16 net starsgojue/ecapture, week to Aug 26: +13 net starsAll other repositories, week to Aug 26: +162 net starscilium/cilium, week to Sep 2: +38 net starscilium/tetragon, week to Sep 2: +27 net starseunomia-bpf/agentsight, week to Sep 2: +56 net starsaya-rs/aya, week to Sep 2: +8 net starsgojue/ecapture, week to Sep 2: +11 net starsAll other repositories, week to Sep 2: +132 net starscilium/cilium, week to Sep 9: +66 net starscilium/tetragon, week to Sep 9: +17 net starseunomia-bpf/agentsight, week to Sep 9: +20 net starsaya-rs/aya, week to Sep 9: +13 net starsgojue/ecapture, week to Sep 9: +12 net starsAll other repositories, week to Sep 9: +105 net starscilium/cilium, week to Sep 16: +63 net starscilium/tetragon, week to Sep 16: +16 net starseunomia-bpf/agentsight, week to Sep 16: +13 net starsaya-rs/aya, week to Sep 16: +9 net starsgojue/ecapture, week to Sep 16: +20 net starsAll other repositories, week to Sep 16: +141 net starscilium/cilium, week to Sep 23: +337 net starscilium/tetragon, week to Sep 23: +22 net starseunomia-bpf/agentsight, week to Sep 23: +14 net starsaya-rs/aya, week to Sep 23: +15 net starsgojue/ecapture, week to Sep 23: +14 net starsAll other repositories, week to Sep 23: +115 net starscilium/cilium, week to Sep 30: +83 net starscilium/tetragon, week to Sep 30: +18 net starseunomia-bpf/agentsight, week to Sep 30: +10 net starsaya-rs/aya, week to Sep 30: +14 net starsgojue/ecapture, week to Sep 30: +6 net starsAll other repositories, week to Sep 30: +139 net starscilium/cilium, week to Oct 7: +43 net starscilium/tetragon, week to Oct 7: +18 net starseunomia-bpf/agentsight, week to Oct 7: +15 net starsaya-rs/aya, week to Oct 7: +15 net starsgojue/ecapture, week to Oct 7: +10 net starsAll other repositories, week to Oct 7: +118 net starscilium/cilium, week to Oct 14: +50 net starscilium/tetragon, week to Oct 14: +15 net starseunomia-bpf/agentsight, week to Oct 14: +15 net starsaya-rs/aya, week to Oct 14: +13 net starsgojue/ecapture, week to Oct 14: +16 net starsAll other repositories, week to Oct 14: +136 net starscilium/cilium, week to Oct 21: +51 net starscilium/tetragon, week to Oct 21: +25 net starseunomia-bpf/agentsight, week to Oct 21: +14 net starsaya-rs/aya, week to Oct 21: +8 net starsgojue/ecapture, week to Oct 21: +19 net starsAll other repositories, week to Oct 21: +232 net starscilium/cilium, week to Oct 28: +28 net starscilium/tetragon, week to Oct 28: +28 net starseunomia-bpf/agentsight, week to Oct 28: +9 net starsaya-rs/aya, week to Oct 28: +16 net starsgojue/ecapture, week to Oct 28: +5 net starsAll other repositories, week to Oct 28: +99 net starscilium/cilium, week to Nov 4: +45 net starscilium/tetragon, week to Nov 4: +29 net starseunomia-bpf/agentsight, week to Nov 4: +9 net starsaya-rs/aya, week to Nov 4: +13 net starsgojue/ecapture, week to Nov 4: +12 net starsAll other repositories, week to Nov 4: +119 net stars

Compare growth

11 of 54 repositories: Created more than 2 years ago, with a push in the last 7 days and a GitHub release in the last 30 days. Select a column name to change the order.

#RepositoryStarsGained, 90 daysPace
1cilium/cilium

eBPF-based Networking, Security, and Observability

26K+9631.4×
2gojue/ecapture

Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64\arm64 and loong64.

16K+1690.6×
3kubeshark/kubeshark

eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.

12K+124–
4bpftrace/bpftrace

High-level tracing language for Linux

10K+169–
5cilium/tetragon

eBPF-based Security Observability and Runtime Enforcement

5.2K+277–
6aya-rs/aya

Aya is an eBPF library for the Rust programming language, built with a focus on developer experience and operability.

4.9K+170–
7cilium/hubble

Hubble - Network, Service & Security Observability for Kubernetes using eBPF

4.4K+108–
8deepflowio/deepflow

eBPF Observability - Distributed Tracing and Profiling

4.3K+114–
9microsoft/ebpf-for-windows

eBPF implementation that runs on top of Windows

3.6K+66–
10sched-ext/scx

sched_ext schedulers and tools

2.2K+134–
11parca-dev/parca-agent

eBPF based always-on CPU/GPU profiler auto-discovering targets in Kubernetes and systemd, zero code changes or restarts needed!

749+11–

Faster than the 30 days before

Net stars of the last 30 days are 2 or more times those of the 30 days before.

No repository with this Tag meets this rule now.

Slower than the 30 days before

Net stars of the last 30 days are 50% or less of those of the 30 days before.

  1. cilium/cilium0.3× · +184

New in the last 90 days

Created on GitHub in the last 90 days.

  1. Neo23x0/process-watcher+114 · 19 days ago

Older than 2 years, still releasing

Created more than 2 years ago, with a push in the last 7 days and a GitHub release in the last 30 days.

  1. cilium/cilium26K · release 2 days ago
  2. gojue/ecapture16K · release 5 days ago
  3. kubeshark/kubeshark12K · release 15 days ago
  4. bpftrace/bpftrace10K · release 11 days ago
  5. cilium/tetragon5.2K · release 5 days ago
All 11 in the table

Last release more than 180 days ago

The newest GitHub release is more than 180 days old. A repository that never published a release is not in this list.

  1. aquasecurity/tracee4.7K · release 11 months ago
  2. pythops/oryx2.6K · release 9 months ago
  3. h3xduck/TripleCross2K · release 4 years ago
  4. foniod/redbpf1.7K · release 4 years ago
  5. mozillazg/ptcpdump1.3K · release 11 months ago
All 21 in the table

Top GitHub topics with this Tag

Primary languages

How a repository gets this Tag

An agent reads the description, the GitHub topics, and the start of the README of each repository. It chooses Tags only from the Tag list in the AwesomeRepos source code. For each Tag, it quotes the text. A code check keeps the Tag only when the quote is in that text. The page of each repository shows the quote of each of its Tags. A Tag does not rank repositories. It does not say that one repository can replace another. To report a wrong Tag, use "Report a problem with this page" on the page of the repository.

How the numbers are counted

All numbers come from the Star History of the repositories that have the Tag now. A period is a run of complete UTC days. All numbers on this page count only the repositories that AwesomeRepos shows in lists. A machine computes them each hour.

For each repository, a period counts only when Star History has each of its days, or when the repository was created in the period. Otherwise the table shows "–". The bars of a week with no complete data are grey.

The Pace is the net stars of a period divided by the net stars of the period before. It shows only when Star History covers each day of the period before, with at least 3 net stars a day on average.

The chart at the top adds up the net stars of all the repositories with the Tag. A rising Admission comes into the Repository Index because it gained stars quickly. Its Star History before its Admission comes from the Repository Host. Thus the days before many rising Admissions are higher than they were for the repositories in the index at that time.

The releases are the GitHub releases of each repository. The lists and the table do not rank repositories, and they do not say that one repository can replace another.