Linux > eBPF
Virtual machine that allows you to write more efficient and powerful tracing and monitoring for Linux systems.
Contents
Other Lists of Resources on eBPF
Articles and Presentations
Generic eBPF Presentations and Articles
Hardware Offload
Tutorials
Involves the use of several BPF tools for tracing.
A progressive (three levels of difficulty) tutorial to learn how to process packets with XDP.
An introductory guide to writing image-based eBPF gadgets and performing post-processing with WASM.
Examples
Jesper Dangaard Brouer's prototype-kernel repository contains some additional examples that can be compiled outside of kernel infrastructure.
Provides basic but complete examples of eBPF applications also compatible with hardware offload.
A heavily commented sample demonstrating how to encapsulate and decapsulate MPLS within IP. The code is commented for those new to BPF development.
A collection of compiled (as ELF object files) samples gathered from several projects, primarily intended to serve as test cases for user space verifiers.
A fully documented and tested example of an eBPF probe that logs all force-kills and prints them out in user-space.
Program that uses XDP/TC-eBPF to provide statefull firewalling and socket redirection.
Projects Related to eBPF
Tooling and framework to write eBPF code in Rust efficiently.
A kubectl plug-in for executing bpftrace programs in a Kubernetes cluster.
Framework for running BPF programs with rules on Linux as a daemon. Container aware.
A distinct BPF daemon, trying to leverage the flexibility of the bcc tools to trace and debug remote targets, and in particular devices running with Android.
A Linux shell environment for using tracing tools on Android with BPFd.
System daemon to compile and load eBPF programs into the kernel, and forward program output to socket for metric aggregation.
An in-kernel solution based on XDP for 5G UPF.
A web interface to explore system's maps and programs.
A TUI (terminal user interface) application for real time monitoring of eBPF programs.
An eBPF Manager for Linux and Kubernetes. Includes a built-in program loader that supports program cooperation for XDP and TC programs, as well as deployment of eBPF programs from OCI images.
A process-aware, eBPF-based tcpdump-like tool.
A TUI for sniffing network traffic using eBPF on Linux.
Networking
project (GitHub repository) is a technology relying on eBPF and XDP to provide "fast in-kernel networking and security policy enforcement for containers based on eBPF programs generated on the fly". Many presentations available (with overlap):
Extreme Performance Tuning guide - Mark II.
Calico is an open source networking and network security solution for containers, virtual machines, and native host-based workloads. Calico's eBPF data plane delivers a low latency, high throughput data plane with a rich network security policy model.
Use eBPF to speed up your Service Mesh. Merbridge replaces iptables rules with eBPF to intercept traffic. It also combines msg_redirect to reduce latency with a shortened datapath between sidecars and services.
An open source C++ library for capturing, parsing and crafting network packets. It features a C++ interface for creating AF_XDP sockets, making it easy to send and receive packets through them.
A high performance and lightweight captive portal solution for wireless networks. It leverages eBPF for traffic control and deep packet inspection capabilities, with plans to gradually replace nftables firewall functionality with eBPF-based solutions.
A proof-of-concept IPX implementation for Linux using eBPF.
Observability
Observability for Kubernetes using eBPF. Features include protocol tracing, application profiling, and support for distributed bpftrace deployments.
Apache SkyWalking is an open-source Application Performance Monitoring (APM) platform specially designed for distributed systems with microservices, cloud-native and container-based (Kubernetes) architectures. SkyWalking Rover is an eBPF-based profiler and metrics collector for C, C++, Golang, and Rust applications.
eBPF based always-on continuous profiler for analysis of CPU and memory usage, down to the line number and throughout time.
Sampling profiler and tracer for Ruby.
Sub-millisecond system monitoring using eBPF tracepoints on schedswitch, schedprocessexit, and schedprocess_free, with zero heap allocations in steady state.
Network, service and security observability for Kubernetes using eBPF.
eBPF-based GPU causal observability agent. Traces CUDA Runtime and Driver APIs via uprobes and host kernel events via tracepoints to build causal chains explaining GPU latency, with <2% overhead.
Instant Kubernetes service dependency map generated by eBPF, right to a Grafana instance.
Instant observability for cloud-native and AI applications based on eBPF.
Coroot is an open-source APM and observability tool, a DataDog and NewRelic alternative.
Kyanos is an eBPF-based network issue analysis tool that enables you to capture network requests, such as HTTP, Redis, and MySQL requests.
eTraceGen is a Linux telemetry engine built with eBPF and Modern C++ that captures kernel-level events for processes, files, system calls, and network with a modular pipeline for decoding, enrichment, filtering, and JSON output.
Security
A security monitoring tool. It depends on SysinternalsEBPF.
A runtime security and forensics tool for Linux which uses eBPF technology to trace the system and applications at runtime, and analyze collected events to detect suspicious behavioral patterns.
A set of BPF programs that gather security relevant event data from the Linux kernel. The BPF programs are combined into a single ELF file from which individual probes can be selectively loaded, depending on the running operating system and kernel version.
An eBPF driven security tool for locking and auditing Linux machines.
Kubernetes-aware, eBPF-based security observability and runtime enforcement.
Trace syscalls from user-space functions, by using eBPF.
Extended detection and response (XDR) with eBPF-powered firewall and proxy, to protect your Linux servers.
BpfJailer is an eBPF-based process jailing system that provides mandatory access control (MAC) for Linux.
An eBPF-based security agent written entirely in Rust using the Aya library and built on LSM (Linux Security Module) BPF hooks.
Open source agent that implements a stateful Sigma rules engine focused on monitoring and prevention using eBPF LSM.
eBPF Workflow: Tools and Utilities
A C library used for handling BPF objects (programs and maps), and manipulating ELF object files containing them. It is shipped with the kernel and mirrored on GitHub.
Scaffolding for BPF application development with libbpf and BPF CO-RE.
Pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.
eBPF library for Go, powered by libbpf.
A pure Rust library for writing, loading, and managing eBPF objects, with a focus on developer experience and operability. It supports writing eBPF programs in Rust and distributing library code over crates.io to share it between eBPF programs. Aya does not depend on libbpf.
Templates for writing BPF applications in Aya that can be used with cargo generate.
A pure Zig framework for writing cross platform eBPF programs, powered by libbpf and Zig toolchain.
A compilation framework and runtime library to build, distribute, dynamically load, and run CO-RE eBPF applications in multiple languages and WebAssembly. It supports writing eBPF kernel code only (to build simple CO-RE libbpf eBPF applications), writing the kernel part in both BCC and libbpf styles, and writing userspace in multiple languages in a WASM module and distributing it with simple JSON data or WASM OCI images. The runtime is based on libbpf only and provides CO-RE to BCC-style eBPF programs without depending on the LLVM library.
bpftool and Other Tools from the Kernel Tree
User Space eBPF
Written in C. Contains an interpreter, a JIT compiler for x86_64 architecture, an assembler and a disassembler.
With support for FreeBSD kernel, FreeBSD user space, Linux kernel, Linux user space and macOS user space. Used for the VALE software switch's BPF extension module.
Written in Rust. Interpreter for Linux, macOS and Windows, and JIT-compiler for x86_64 under Linux.
A user space verifier for eBPF using an abstract interpretation layer, with support for loops.
A tracing profiler that aims to make eBPF uprobe-based debugging easier to use. This is done by displaying traces in a UI next to the source code and allowing interactive drilldown analysis.
eBPF on Other Platforms
Testing in Virtual Environments
eBPF in Security
A rootkit that leverages multiple eBPF features to implement offensive security techniques.
An utility to statically analyze eBPF bytecode or monitor suspicious eBPF activity at runtime. It was specifically designed to detect ebpfkit.
A collection of malicious eBPF programs that make use of eBPF's ability to read and write user data in between the usermode program and the kernel.
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.