capstone-engine / capstone
Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.
netblue30 / firejail
Linux namespaces and seccomp-bpf sandbox
eunomia-bpf / bpf-developer-tutorial
eBPF Developer Tutorial: Learning eBPF Step by Step with Examples
cilium / tetragon
eBPF-based Security Observability and Runtime Enforcement
inspektor-gadget / inspektor-gadget
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF
mito753 / Kernel-Exploit-Dojo
CTF kernel exploitation notes, PoCs, exploits, and writeups.
eunomia-bpf / agentsight
lightweight system-level observability for AI Agents
gojue / ecapture
Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64 and arm64.
microsoft / ebpf-for-windows
eBPF implementation that runs on top of Windows
the-tcpdump-group / tcpdump
the TCPdump network dissector
mozillazg / ptcpdump
Process-aware, eBPF-based tcpdump
elesiuta / picosnitch
Monitor network traffic per executable
Xinyuan-LilyGO / LilyGo-LoRa-Series
LILYGO LoRa Series examples
iovisor / bcc
BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
hengyoush / kyanos
Kyanos is a networking analysis tool using eBPF. It can visualize the time packets spend in the kernel, capture requests/responses, makes troubleshooting more efficient.
xdp-project / bpf-examples
Making eBPF programming easier via build env and examples
cilium / pwru
Packet, where are you? -- eBPF-based Linux kernel networking debugger
the-tcpdump-group / libpcap
the LIBpcap interface to various kernel packet capture mechanism
libbpf / libbpf
Automated upstream mirror for libbpf stand-alone build.
qpoint-io / qtap
Qtap: An eBPF agent that captures pre-encrypted network traffic, providing rich context about egress connections and their originating processes.
solo-io / bumblebee
Get eBPF programs running from the cloud to the kernel in 1 line of bash
open-telemetry / opentelemetry-go-instrumentation
OpenTelemetry Auto Instrumentation using eBPF
seccomp / libseccomp
The main libseccomp repository
linuxkerneltravel / lmp
LMP provides an eBPF Supermarket for developers, including eBPF tools, open-source projects based on eBPF, eBPF learning materials, Linux kernel learning materials, and more.
libbpf / bpftool
Automated upstream mirror for bpftool stand-alone build.
carloslack / KoviD
Red-Team LKM
open-telemetry / opentelemetry-ebpf-instrumentation
Zero-code OpenTelemetry instrumentation powered by eBPF
cn0xroot / ArgusBPF
eBPF-based system & AI-agent activity monitor with a bilingual professional/plain-language web dashboard
bomfather / agent
An eBPF runtime security agent