Kubernetes Security Profile Generator Using eBPF
Detects silently-dropped NetworkPolicy traffic by counting TCP SYN retransmissions — brilliant.
eBPF Runtime Reporter and Profiler
Unifies bpftop call counts with perf source-line profiling in one TUI.
eBPF developers, kernel engineers, performance engineers
bpftop · bpftrace · perf
This is a tool for profiling eBPF programs themselves, probe->kernel activity, interactions with shared hash maps, etc.
Since eBPF programs are pieces of machine code residing in (kernel) address space, you could profile them with standard perf just like any other kernel function. However, perf alone won't show you other useful metrics like number of executions and average eBPF program runtime, like bpftop does. Also, I want an easy way to map CPU samples to original source code lines, where possible.
I wanted to unify both approaches, display the bpftop-style call count & probe latency, with the ability to drill down inside where the eBPF program spends most of it's time.
Detects silently-dropped NetworkPolicy traffic by counting TCP SYN retransmissions — brilliant.
Kernel-level intent tracking stops AI exfiltration where EDR and Docker fail.
eBPF kernel hooks enforce agent boundaries at <0.05ms latency; no API polling tax.
eBPF runtime visibility for AI agents—first tool solving the trust problem with Claude Code and similar.
Line-frequency profiling beats coverage tools; live Vue.js UI without server overhead.
LSM hooks block operations synchronously; most eBPF security tools only alert asynchronously.