zoidbergwill/awesome-ebpf

A curated list of awesome projects related to eBPF.

awesome-ebpf's Issues

Add ebpf.io

https://ebpf.io + https://ebpf.io/projects

ebpf-samples points to 404

ebpf-samples - A collection of compiled (as ELF object files) samples gathered from several projects, primarily intended to serve as test cases for user space verifiers.

Link to linux/Documentation/networking/filter.txt is dead

in README.md

Double check we have all the bcc links

links.md

ebpf support for rust debugging

Is there any useful libraries/tools that we can use to debug codes written in Rust? (Not tools written by Rust)

Maybe mention socket-connect-bpf

Hi there!
I created socket-connect-bpf. It is similar to tcpconnect, but the probe is attached to security_socket_connect and it provides some additional information (like process path and AS information).

However, I don't know if it's unique enough to have an entry in this list. What do you think?

Discussion: Tidying up the README.md

I'd like to figure out a sensible order for sections and how to break it into sub-sections, since some projects are FOSS and some are private/propietary.

Ideally I'd like to figure out a sustainable way to keep SNR of the repo high. I think ordering talks by year makes sense for evolving tech, but then I'm not sure if things that feature eBPF but not as a focus make sense in the repo, I think they do if they're of interest of people that wanna learn more about it.

merbridge is a simple tool to acclerate your mesh with eBPF

https://github.com/merbridge/merbridge/

Merbridge: use eBPF to accelerate your mesh

https://landscape.cncf.io/card-mode?category=service-mesh&grouping=category&selected=merbridge
It is also included in CNCF landscape.

I'm not sure which part should I add this project to.

• https://istio.io/latest/blog/2022/merbridge/

Polycube

Just wanted to turn you on to polycube project: https://github.com/polycube-network/polycube

BPF and XDP are the main Linux kernel technologies on which Polycube is based upon. BPF supports dynamic code injection in the Linux kernel at runtime, enabling the dynamic creation of a data plane. The BPF data plane has a minimal feature set which avoids processing overhead and is exactly tailored to user needs.

It appears to be a container-focused networking platform, with some new conventions mixed with emulation of familiar legacy API - e.g.:

pcn-iptables: is a clone of iptables that is able to filter packets passing through a Linux host, demonstrating how packet filtering can be achieved with impressive performance, while at the same time guaranteeing the same command line and the same external behavior of the original software.

Get the list referenced on https://github.com/sindresorhus/awesome

We should try to get this list in order and to submit it for inclusion into the list of “awesome” material lists.

See the requirements.

Missing items, as far as I can see:

• GitHub topics (the repo should have awesome-list and awesome, and I suppose bpf and ebpf at least).
• Formatting should be fixed (all lines starting with a link, then “-” (dash) should be used to separate the description, which should be harmonised (case, punctuation)).
• The BPF description may need to be moved above the ToC, as per their example.
• We should run the awesome-lint tool to check if anything else is amiss (I didn't manage to make it work, on a quick attempt).
• They suggest to add a logo, but I don't see what we could use and it does not sound mandatory.
• Submitter must review at least two other PRs for that other awesome repo.

Mention flowmill

The core of their product comes from eBPF, and the product fills a pretty big hole in the current ways that monitoring systems work.

https://www.flowmill.com/product/

add bpfman

an eBPF manager

website https://bpfman.io/main/

Mention 4.16 TCP Tracepoints

http://www.brendangregg.com/blog/2018-03-22/tcp-tracepoints.html
https://github.com/torvalds/linux/blob/v4.16-rc7/include/trace/events/tcp.h

mention two vbpf projects: verifier and samples

• ebpf-verifier: an alternative verifier, based on abstract interpretation (proof of concept)
• ebpf-samples: a collection of compiled eBPF programs from open source projects

What about spliting "Projects Related to eBPF" according to their area

Considering that people use ebpf for a variety of purposes, it would be clearer if projects were divided by area.

For example, we can have networking (cilium), observability (skywalking rover), tool (bpftrace), library (gobpf), and security (tetragon).

Mention cgnet

cgnet uses eBPF to gather network statistics from cgroups.

https://github.com/kinvolk/cgnet

Implement TODO

Thank you for posting this helpful Awesome list! Unfortunately, the TODO on What is BPF? was exactly what I was hoping for in this doc. Is this just a network packet filter, or something else?

Wishlist for tools/docs/libs

What are some docs, tools or other resources that the eBPF ecosystem is missing? For instance, we don't have a eBPF debugger AFAIK. It might be good to have a "wishlist" section in the README if there is content.

Using eBPF to hook tx packet