libbpf

eBPF Developer Tutorial: Learning eBPF Step by Step with Examples

XDP tutorial

Automated upstream mirror for libbpf stand-alone build.

Prometheus exporter for custom eBPF metrics

A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.

Qtap: An eBPF agent that captures pre-encrypted network traffic, providing rich context about egress connections and their originating processes.

Minimal and opinionated eBPF tooling for the Rust ecosystem

A Tool to make Build and Run eBPF programs easier

Automated upstream mirror for bpftool stand-alone build.

WebAssembly library, toolchain and runtime for eBPF programs

极客时间专栏《eBPF 核心技术与实战》案例

surftrace is a tool that allows you to surf the linux kernel

Hades is a Host-Based Intrusion Detection System based on eBPF(mainly)

Writing eBPF programs with Elixir!

An high-performance, cross-platform Python binding for capturing, modifying, and dropping network packets. It supports Windows via WinDivert and Linux via eBPFDivert, an eBPF implementation of the WinDivert API. Both backends use the same filter language, layers, flags and packet metadata.

Examples for aquasecurity/libbpfgo and cilium/ebpf

Live, system-wide USB transfer sniffer in eBPF — decodes USB traffic inline (control SETUP, SCSI, HID) from two universal URB hooks. No usbmon, no hardware sniffer. CO-RE portable.

Template designed to get new developers with libbpf development.

A Rust library to write and load bpf programs built on top of libbpf (no bcc dependency).

Ethereum p2p traffic analysis with eBPF