Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.

Packet, where are you? -- eBPF-based Linux kernel networking debugger

Kyanos is a networking analysis tool based on eBPF. It can visualize the time packets spend in the kernel, capture requests/responses in command line, calculates various aggregated metrics, makes troubleshooting more efficient.

the TCPdump network dissector

eBPF Developer Tutorial: Learning eBPF Step by Step with Examples

the LIBpcap interface to various kernel packet capture mechanism

XDP tutorial

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF

Automated upstream mirror for libbpf stand-alone build.

bpftune uses BPF to auto-tune Linux systems

bpf 学习仓库

The main libseccomp repository

Process-aware, eBPF-based tcpdump

Alaz: Advanced eBPF Agent for Kubernetes Observability – Effortlessly monitor K8s service interactions and performance metrics in your K8s environment. Gain in-depth insights with service maps, metrics, and more, while staying alert to crucial system anomalies 🐝

A firewall that utilizes the Linux kernel's XDP hook. The XDP hook allows for very fast network processing on Linux systems. This is great for dropping malicious traffic from a (D)DoS attack. IPv6 is supported with this firewall! I hope this helps network engineers/programmers interested in utilizing XDP!

Making eBPF programming easier via build env and examples

In-kernel cache based on eBPF.

Automated upstream mirror for bpftool stand-alone build.

A packet oriented Linux kernel function call tracer

Linux kernel rootkit