SaaSHub helps you find the best software and product alternatives Learn more →
Top 23 C Bpf Projects
-
capstone
Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.
Project mention: Capstone – lightweight multi-platform, multi-architecture disassembly framework | news.ycombinator.com | 2026-06-02 -
AppSignal
AppSignal knows why the f*#k it crashed. Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.
-
kyanos
Kyanos is a networking analysis tool using eBPF. It can visualize the time packets spend in the kernel, capture requests/responses, makes troubleshooting more efficient.
-
Project mention: Building a Production eBPF Observability & Security Stack for Kubernetes in 2026 | dev.to | 2026-03-30
# Install Tetragon via Helm helm repo add cilium https://helm.cilium.io helm repo update helm install tetragon cilium/tetragon \ --namespace kube-system \ --set tetragon.grpc.address="localhost:54321" \ --set tetragon.exportFilename="/var/run/cilium/tetragon/tetragon.log" \ --set tetragon.enableProcessCred=true \ --set tetragon.enableProcessNs=true # Install tetra CLI (for event observation) GOOS=$(go env GOOS) GOARCH=$(go env GOARCH) curl -L --remote-name-all \ https://github.com/cilium/tetragon/releases/latest/download/tetra-${GOOS}-${GOARCH}.tar.gz sudo tar -C /usr/local/bin -xzvf tetra-${GOOS}-${GOARCH}.tar.gz rm tetra-${GOOS}-${GOARCH}.tar.gz
-
You can hook the system call to open a file regardless of libc use. If for some strange reason you really wanted to patch libc and the program you're using statically links it (ex musl) that isn't an issue - just patch the relevant libc implementation and recompile. But more generally, if you have access to the source code then why would you not directly patch the program in question instead of resorting to these sorts of shenanigans?
Seriously, you're doing it wrong. Just hook the relevant system call and be done with it. Your usecase is literally one of the first eBPF tutorials that comes up when looking for information about modifying system call arguments. https://github.com/eunomia-bpf/bpf-developer-tutorial/tree/m...
-
It is also not the first tool to follow packets through that path. The project is explicitly inspired by pwru, which showed how useful broad eBPF packet tracing can be.
-
Project mention: What Really Happens When You Access AWS: Complete Data Flow Example | dev.to | 2025-11-11
tcpdump - Command-line packet analyzer
-
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
-
-
inspektor-gadget
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF
-
libbpf Iterator API: https://github.com/libbpf/libbpf
-
Project mention: Automated Kernel Tuning: Say Goodbye to Static sysctl with bpftune 🚀 | dev.to | 2026-02-14
Oracle bpftune GitHub Repository
-
Sigh.
I'm still waiting for a systems engineering tool that can log every layer, and handle SSL the whole pipe wide.
Im covering everything from strafe and ltrace on the machine, file reads, IO profiling, bandwidth profiling. Like, the whole thing, from beginning to end.
Theres no tool that does that.
Hell, I can't even see good network traces within a single Linux app. The closest you'll find is https://github.com/mozillazg/ptcpdump
But especially with Firefox, good luck.
-
https://github.com/seccomp/libseccomp/releases
> Somehow we ended up with an overengineered mess of leaky abstractions for cloud-based, vendor-locked infrastructure.
Wait a moment - he cites Docker. That's owned by a private company. What does this have to do with Linux? If company xyz does something based on FreeBSD, we would then say company xyz is responsible for FreeBSD failing or not failing? How does that work?
> And this complexity has quietly reshaped how the industry thinks about deploying software. Today, if you want to run an application in a larger system, the implicit assumption is that you containerise it with Docker and orchestrate it with Kubernetes.
Personally I find all this abstraction crap. With all their failures, though, things such as docker kind of present a "download this one file, then it will work fine". And that is kind of true. I saw that in in-campus use for life science faculty clusters and what not. It simplifies things for the admin there. People give a similar rationale for systemd. Personally I don't think systemd should exist, but there are people who benefit from it - that simply is a factual statement.
All in all this is a very strange point of view from FreeBSD folks. At the least the NetBSD folks back then on the mailing list acknowledged the situation and then tried to find alternative strategies and in some ways succeeded (although I am not sure whether NetBSD right now runs on more toasters than Linux does - anyone has updated statistics for that?).
-
alaz
Alaz: Advanced eBPF Agent for Kubernetes Observability – Effortlessly monitor K8s service interactions and performance metrics in your K8s environment. Gain in-depth insights with service maps, metrics, and more, while staying alert to crucial system anomalies 🐝
-
-
-
-
-
-
Project mention: Furtex: Post-exploitation and evasion research toolkit for Linux | news.ycombinator.com | 2026-07-21
-
-
-
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
NOTE:
The open source projects on this list are ordered by number of github stars.
The number of mentions indicates repo mentiontions in the last 12 Months or
since we started tracking (Dec 2020).
C Bpf discussion
C Bpf related posts
-
Show HN: SwiftNet 0.6.0 – Lightweight l2 C networking lib (pcap and early DPDK)
-
I Had a Lot of Fun Building a Linux Packet Flight Recorder
-
I'm a Dev Who Barely Knows the Kernel. Here's How I'm Learning How to Track a Packet with pwru
-
eBPF en 2026: La Máquina Virtual Oculta dentro de Linux
-
eBPF in 2026: The Kernel Revolution Powering Cloud-Native Security and Observability
-
Back to FreeBSD: Part 1
-
Automated Kernel Tuning: Say Goodbye to Static sysctl with bpftune 🚀
-
A note from our sponsor - SaaSHub
www.saashub.com | 7 Oct 2026
Index
What are some of the best open-source Bpf projects in C? This list will help you:
| # | Project | Stars |
|---|---|---|
| 1 | capstone | 9,046 |
| 2 | kyanos | 5,070 |
| 3 | tetragon | 5,049 |
| 4 | bpf-developer-tutorial | 4,303 |
| 5 | pwru | 3,836 |
| 6 | tcpdump | 3,240 |
| 7 | libpcap | 3,173 |
| 8 | xdp-tutorial | 2,982 |
| 9 | inspektor-gadget | 2,932 |
| 10 | libbpf | 2,762 |
| 11 | bpftune | 1,886 |
| 12 | ptcpdump | 1,281 |
| 13 | libseccomp | 934 |
| 14 | alaz | 713 |
| 15 | bpftool | 709 |
| 16 | bpf-examples | 569 |
| 17 | bmc-cache | 464 |
| 18 | ipftrace2 | 409 |
| 19 | honey-potion | 296 |
| 20 | Furtex | 287 |
| 21 | npf | 262 |
| 22 | bpfcov | 137 |
| 23 | traffico | 114 |
Sponsored
AppSignal knows why the f*#k it crashed.
Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.
www.appsignal.com