AwesomeRepos
Sign in

Tags / Operating systems and systems /

eBPF tool

Tool or library that uses eBPF programs in the kernel for tracing, networking, or security.

The 31repositories with this Tag gained +1,032 net stars in the last 30 days, 21% less than the 30 days before.

1 created in the last 90 days · 14 published a release in the last 30 days · 158K stars in total

All in the Repository Index On Trending

Net stars each day, last 30 days+249 last 7 days

Oct 5, 2026Nov 3, 2026

  • Seed Dataset
  • Rising Admissions

Most net stars, last 30 days

cilium/cilium

eBPF-based Networking, Security, and Observability

+185

18% of the net stars of this Tag

Largest Pace, last 30 days

No other repository gained 2 or more times the net stars of the 30 days before.

Most stars, created in the last 90 days

Neo23x0/process-watcher

A process monitoring tool that tries to detect exploitation

114

stars in total · created 18 days ago

Where the stars went, last 13 weeks

Net stars gained each week. The repositories that gained the most have their own color.

cilium/cilium gained 28% of the net stars of this Tag in the last 13 weeks.

cilium/cilium, week to Aug 11: +61 net starscilium/tetragon, week to Aug 11: +18 net starseunomia-bpf/agentsight, week to Aug 11: +18 net starsgojue/ecapture, week to Aug 11: +22 net starsaya-rs/aya, week to Aug 11: +13 net starsAll other repositories, week to Aug 11: +144 net starscilium/cilium, week to Aug 18: +60 net starscilium/tetragon, week to Aug 18: +23 net starseunomia-bpf/agentsight, week to Aug 18: +17 net starsgojue/ecapture, week to Aug 18: +10 net starsaya-rs/aya, week to Aug 18: +19 net starsAll other repositories, week to Aug 18: +143 net starscilium/cilium, week to Aug 25: +48 net starscilium/tetragon, week to Aug 25: +23 net starseunomia-bpf/agentsight, week to Aug 25: +11 net starsgojue/ecapture, week to Aug 25: +11 net starsaya-rs/aya, week to Aug 25: +15 net starsAll other repositories, week to Aug 25: +159 net starscilium/cilium, week to Sep 1: +37 net starscilium/tetragon, week to Sep 1: +27 net starseunomia-bpf/agentsight, week to Sep 1: +51 net starsgojue/ecapture, week to Sep 1: +15 net starsaya-rs/aya, week to Sep 1: +8 net starsAll other repositories, week to Sep 1: +113 net starscilium/cilium, week to Sep 8: +63 net starscilium/tetragon, week to Sep 8: +17 net starseunomia-bpf/agentsight, week to Sep 8: +23 net starsgojue/ecapture, week to Sep 8: +9 net starsaya-rs/aya, week to Sep 8: +12 net starsAll other repositories, week to Sep 8: +115 net starscilium/cilium, week to Sep 15: +53 net starscilium/tetragon, week to Sep 15: +17 net starseunomia-bpf/agentsight, week to Sep 15: +15 net starsgojue/ecapture, week to Sep 15: +20 net starsaya-rs/aya, week to Sep 15: +11 net starsAll other repositories, week to Sep 15: +120 net starscilium/cilium, week to Sep 22: +324 net starscilium/tetragon, week to Sep 22: +21 net starseunomia-bpf/agentsight, week to Sep 22: +15 net starsgojue/ecapture, week to Sep 22: +17 net starsaya-rs/aya, week to Sep 22: +16 net starsAll other repositories, week to Sep 22: +118 net starscilium/cilium, week to Sep 29: +108 net starscilium/tetragon, week to Sep 29: +17 net starseunomia-bpf/agentsight, week to Sep 29: +8 net starsgojue/ecapture, week to Sep 29: +4 net starsaya-rs/aya, week to Sep 29: +10 net starsAll other repositories, week to Sep 29: +129 net starscilium/cilium, week to Oct 6: +46 net starscilium/tetragon, week to Oct 6: +20 net starseunomia-bpf/agentsight, week to Oct 6: +16 net starsgojue/ecapture, week to Oct 6: +11 net starsaya-rs/aya, week to Oct 6: +14 net starsAll other repositories, week to Oct 6: +100 net starscilium/cilium, week to Oct 13: +43 net starscilium/tetragon, week to Oct 13: +13 net starseunomia-bpf/agentsight, week to Oct 13: +16 net starsgojue/ecapture, week to Oct 13: +14 net starsaya-rs/aya, week to Oct 13: +13 net starsAll other repositories, week to Oct 13: +130 net starscilium/cilium, week to Oct 20: +56 net starscilium/tetragon, week to Oct 20: +24 net starseunomia-bpf/agentsight, week to Oct 20: +13 net starsgojue/ecapture, week to Oct 20: +19 net starsaya-rs/aya, week to Oct 20: +13 net starsAll other repositories, week to Oct 20: +140 net starscilium/cilium, week to Oct 27: +26 net starscilium/tetragon, week to Oct 27: +23 net starseunomia-bpf/agentsight, week to Oct 27: +5 net starsgojue/ecapture, week to Oct 27: +4 net starsaya-rs/aya, week to Oct 27: +9 net starsAll other repositories, week to Oct 27: +170 net starscilium/cilium, week to Nov 3: +47 net starscilium/tetragon, week to Nov 3: +34 net starseunomia-bpf/agentsight, week to Nov 3: +13 net starsgojue/ecapture, week to Nov 3: +15 net starsaya-rs/aya, week to Nov 3: +20 net starsAll other repositories, week to Nov 3: +120 net stars

Compare growth

31 repositories with this Tag. Select a column name to change the order.

#RepositoryStarsGained, 7 daysPace
1cilium/cilium

eBPF-based Networking, Security, and Observability

26K+471.8×
2cilium/tetragon

eBPF-based Security Observability and Runtime Enforcement

5.2K+341.5×
3aya-rs/aya

Aya is an eBPF library for the Rust programming language, built with a focus on developer experience and operability.

4.9K+20–
4sched-ext/scx

sched_ext schedulers and tools

2.2K+17–
5bpftrace/bpftrace

High-level tracing language for Linux

10K+16–
6gojue/ecapture

Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64\arm64 and loong64.

16K+15–
7kubeshark/kubeshark

eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.

12K+15–
8iovisor/bcc

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

23K+13–
9eunomia-bpf/agentsight

lightweight system-level observability for AI Agents

769+13–
10deepflowio/deepflow

eBPF Observability - Distributed Tracing and Profiling

4.3K+9–
11microsoft/ebpf-for-windows

eBPF implementation that runs on top of Windows

3.6K+9–
12pythops/oryx

🕵️‍♂️ TUI for sniffing network traffic using eBPF on Linux

2.6K+9–
13cilium/ebpf

ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.

8K+8–
14aquasecurity/tracee

Linux Runtime Security and Forensics using eBPF

4.7K+8–
15cilium/hubble

Hubble - Network, Service & Security Observability for Kubernetes using eBPF

4.4K+6–
16mozillazg/ptcpdump

Process-aware, eBPF-based tcpdump

1.3K+5–
17libbpf/libbpf

Automated upstream mirror for libbpf stand-alone build.

2.8K+3–
18cilium/pwru

Packet, where are you? -- eBPF-based Linux kernel networking debugger

3.8K+2–
19h3xduck/TripleCross

A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.

2K+2–
20bpfman/bpfman

An eBPF Manager for Linux and Kubernetes

772+1–

Faster than the 30 days before

Net stars of the last 30 days are 2 or more times those of the 30 days before.

No repository with this Tag meets this rule now.

Slower than the 30 days before

Net stars of the last 30 days are 50% or less of those of the 30 days before.

  1. cilium/cilium0.3× · +185

New in the last 90 days

Created on GitHub in the last 90 days.

  1. Neo23x0/process-watcher+114 · 18 days ago

Older than 2 years, still releasing

Created more than 2 years ago, with a push in the last 7 days and a GitHub release in the last 30 days.

  1. cilium/cilium26K · release yesterday
  2. gojue/ecapture16K · release 4 days ago
  3. kubeshark/kubeshark12K · release 14 days ago
  4. bpftrace/bpftrace10K · release 11 days ago
  5. cilium/tetragon5.2K · release 5 days ago
All 12 in the table

Last release more than 180 days ago

The newest GitHub release is more than 180 days old. A repository that never published a release is not in this list.

  1. aquasecurity/tracee4.7K · release 11 months ago
  2. pythops/oryx2.6K · release 9 months ago
  3. h3xduck/TripleCross2K · release 4 years ago
  4. foniod/redbpf1.7K · release 4 years ago
  5. mozillazg/ptcpdump1.3K · release 11 months ago
All 10 in the table

Top GitHub topics with this Tag

Primary languages

How a repository gets this Tag

An agent reads the description, the GitHub topics, and the start of the README of each repository. It chooses Tags only from the Tag list in the AwesomeRepos source code. For each Tag, it quotes the text. A code check keeps the Tag only when the quote is in that text. The page of each repository shows the quote of each of its Tags. A Tag does not rank repositories. It does not say that one repository can replace another. To report a wrong Tag, use "Report a problem with this page" on the page of the repository.

How the numbers are counted

All numbers come from the Star History of the repositories that have the Tag now. A period is a run of complete UTC days. All numbers on this page count only the repositories that AwesomeRepos shows in lists. A machine computes them each hour.

For each repository, a period counts only when Star History has each of its days, or when the repository was created in the period. Otherwise the table shows "–". The bars of a week with no complete data are grey.

The Pace is the net stars of a period divided by the net stars of the period before. It shows only when Star History covers each day of the period before, with at least 3 net stars a day on average.

The chart at the top adds up the net stars of all the repositories with the Tag. The darker area is the part from the Seed Dataset; the rest is from rising Admissions. A rising Admission comes into the Repository Index because it gained stars quickly. Its Star History before its Admission comes from the Repository Host. Thus the days before many rising Admissions are higher than they were for the repositories in the index at that time. The repositories of the Seed Dataset are a set that does not change.

The releases are the GitHub releases of each repository. The lists and the table do not rank repositories, and they do not say that one repository can replace another.