ebpf
Cloud-Native Load-balancer.
loxilb is an open source cloud-native load-balancer based on GoLang/eBPF with the goal of achieving cross-compatibility across a wide range of on-prem, public-cloud or hybrid K8s environments. loxilb is being developed to support the adoption of cloud-native tech in telco, mobility, and edge computing.
Dynamically program the kernel for efficient networking, observability, tracing, and security.
eBPF is a revolutionary technology with origins in the Linux kernel that can run sandboxed programs in a privileged context such as the operating system kernel. It is used to safely and efficiently extend the capabilities of the kernel without requiring to change kernel source code or load kernel modules.
Related contents:
Network Observability for the AI Era.
eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.
Tools for BPF-based Linux IO analysis, networking, monitoring, and more.
BCC is a toolkit for creating efficient kernel tracing and manipulation programs, and includes several useful tools and examples. It makes use of extended BPF (Berkeley Packet Filters), formally known as eBPF, a new feature that was first added to Linux 3.15. Much of what BCC uses requires Linux 4.1 and above.
Related contents:
Instant Distributed Tracing. Enterprise-Grade OpenTelemetry. Distributed tracing without code changes. 🚀 Instantly monitor any application using OpenTelemetry and eBPF.
Accelerate OpenTelemetry implementation with Odigos, an eBPF-based solution providing zero-code, zero-performance overhead for deeper tracing
Odigos is an open-source distributed tracing solution that simplifies and improves observability for Kubernetes environments and Virtual Machines. It provides instant tracing capabilities without requiring any code changes to your applications.
eBPF-based Security Observability and Runtime Enforcement.
Tetragon is a flexible Kubernetes-aware security observability and runtime enforcement tool that applies policy and filtering directly with eBPF, allowing for reduced observation overhead, tracking of any process, and real-time enforcement of policies.
Related contents:
- Automated Kubernetes Threat Detection with Tetragon and Azure Sentinel @ Saraswathi Lakshman's Medium.
- Tetragon: An End-of-Year 2025 Reflection @ Cilium.
- Mon premier contact avec Tetragon @ Le blog de Little Jo :fr:.
- First Contact with Tetragon @ The Little Jo's Blog.
- Installons Tetragon dans Kubernetes @ Le blog de Little Jo :fr:.
- Kubernetes Runtime Security : The Guide @ cilium.
Think EDR, but for CI/CD Pipelines. Open-source eBPF-powered runtime security sensor for GitHub Actions and GitLab CI/CD.
Linux Native, API-Aware Networking and Security for Containers. eBPF-based Networking, Observability, Security.
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides a simple flat Layer 3 network with the ability to span multiple clusters in either a native routing or overlay mode. It is L7-protocol aware and can enforce network policies on L3-L7 using an identity based security model that is decoupled from network addressing.
Related contents:
eBPF implementation that runs on top of Windows.
eBPF is a well-known technology for providing programmability and agility, especially for extending an OS kernel, for use cases such as DoS protection and observability. This project is a work-in-progress that allows existing eBPF toolchains and APIs familiar in the Linux ecosystem to be used on top of Windows. That is, this project takes existing eBPF projects as submodules and adds the layer in between to make them run on top of Windows.
Dynamic Tracing in Linux.
A light-weight dynamic tracer for Linux that leverages the kernel's BPF VM in concert with kprobes and tracepoints to attach probes to arbitrary points in the kernel. Most tracers that generate BPF bytecode are based on the LLVM based BCC toolchain. ply on the other hand has no required external dependencies except for libc. In addition to x86_64, ply also runs on aarch64, arm, loongarch, mips, riscv64, riscv32, and powerpc. Adding support for more ISAs is easy.
Related contents:
Threat-hunting tool for Linux . Bring your Linux Threat-Hunting capabilities to the next level.
Kunai is a powerful tool designed to bring actionable insights for tasks such as security monitoring and threat hunting on Linux systems. Think of it as the Linux counterpart to Sysmon on Windows, tailored for comprehensive and precise event monitoring.
Related contents:
An open-source observability platform built for simplicity. Say goodbye to manual analysis of metrics, logs, and traces. Gain actionable insights and focus on remediation.
Coroot is an open-source APM & Observability tool, a DataDog and NewRelic alternative 📊, 🖥️, 👉. Powered by eBPF for rapid insights into system performance. Monitor, analyze, and optimize your infrastructure effortlessly for peak reliability at any scale.
Rustinel is an open-source endpoint detection project for Windows and Linux.
It collects native host telemetry using ETW on Windows and eBPF on Linux, normalizes events into a shared model, evaluates Sigma, YARA, and IOC detections, and writes alerts as ECS NDJSON.
Rustinel is designed for blue teams, detection engineers, researchers, and anyone who wants a transparent endpoint detection engine they can inspect, run, test, and extend.
Dynamic Tracing for Linux.
bpftrace is a high-level tracing language for Linux and provides a quick and easy way for people to write observability-based eBPF programs, especially those unfamiliar with the complexities of eBPF.
Related contents:
bpftune aims to provide lightweight, always-on auto-tuning of system behaviour. The key benefit it provides are
- by using BPF observability features, we can continuously monitor and adjust system behaviour.
- because we can observe system behaviour at a fine grain (rather than using coarse system-wide stats), we can tune at a finer grain too (individual socket policies, individual device policies etc).
Related contents:
A Simple & Powerful Network Tracing Tool.
Visualize the time packets spend in the kernel, watch & analyze in command line. Capture http/redis/mysql requests/responses in command line.
tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF.
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF.
It manages the packaging, deployment and execution of Gadgets (eBPF programs encapsulated in OCI images) and provides mechanisms to customize and extend Gadget functionality.
Related contents:
eBPF-based auto-instrumentation.
Grafana Beyla is an open source eBPF-based auto-instrumentation tool that helps you easily get started with application observability for Go, C/C++, Rust, Python, Ruby, Java, NodeJS, .NET, and more.
Related contents:
A top for eBPF programs.real-time view of running eBPF programs.
Real-time average runtime per call, events/s, and CPU utilization for every loaded eBPF program.
This repository provides eBPF instrumentation based on the OpenTelemetry standard. It provides a lightweight and efficient way to collect telemetry data using eBPF for user-space applications.
OpenTelemetry e-BPF Instrumentation is commonly referred to as OBI.
Related contents:
sched_ext is a Linux kernel feature which enables implementing kernel thread schedulers in BPF and dynamically loading them. This repository contains various scheduler implementations and support utilities.
Related contents:
High speed TLS signature filtering.
Instead of taking the full JA4 hash to fingerprint traffic which is slow to calculate and is hard to implement in a BPF filter, I take a Jenkins hash of the sorted supported ciphers in any given TLS request. To similar effect as JA4, keeping fingerprinting usefulness. Switching to a non-cryptographic hashing algorithm is okay here because any given attacker with enough skill could replicate the ciphers of another client, so any hash reversing would be useless or at best force the attacker to implement a different amount of hashes.
Related contents:
Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64.
Network Top -- Help you monitor network traffic with bpf.
netop is a terminal command line interface that can customize the
network traffic bpf filter rule 🎯.
Related contents:
High-level tracing language for Linux.
bpftrace is a high-level tracing language for Linux. bpftrace uses LLVM as a backend to compile scripts to eBPF-bytecode and makes use of libbpf and bcc for interacting with the Linux BPF subsystem, as well as existing Linux tracing capabilities: kernel dynamic tracing (kprobes), user-level dynamic tracing (uprobes), tracepoints, etc. The bpftrace language is inspired by awk, C, and predecessor tracers such as DTrace and SystemTap.
Kmesh is a high-performance service grid data plane software implemented based on the ebpf and programmable kernel. It adopts the sidecarless architecture and does not need to deploy proxy components on the data plane. It implements the service governance function and improves the forwarding performance of service access.
Related contents: