Dev tools · alternatives · 2026

24 alternatives to eBPF-powered L4 package dropper

eBPF/XDP packet filtering for Linux. Contribute to boratanrikulu/durdur development by creating an account on GitHub.

eBPF-powered L4 package dropper is a networking tool that uses eBPF technology to drop packets at Layer 4 of the network stack. It is designed for developers and network administrators who need to filter or block… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. eBPF-powered L4 package dropper launched in 2022; newer entries below may have overtaken it.

1
Write your BPF programs in Go, not C▲112
Write your BPF programs in Go, not C. gobee transpiles a Go subset to BPF C and generates typed cilium/ebpf bindings. - boratanrikulu/gobee
May 2026 · github.com · its alternatives →
2
Credentials dumper for Linux using eBPF▲235
Credentials Dumper for Linux using eBPF. Contribute to citronneur/pamspy development by creating an account on GitHub.
2022 · github.com · its alternatives →
3
Goroutine Monitor Powered by eBPF▲75
An eBPF tool monitoring a goroutine. Contribute to keisku/gmon development by creating an account on GitHub.
2024 · github.com · its alternatives →
4
Xcapture-BPF – like Linux top, but with Xray vision▲447
Always on Profiling for Production Systems
2024 · 0x.tools · its alternatives →
5
Drop – a rootless Linux sandbox with gVisor support▲193
Drop: a rootless Linux sandbox for developers. It isolates coding agents and third-party packages while preserving your work environment.
30d ago · droprun.sh · its alternatives →
6
I wrote a load balancer with XDP and Go▲15
Facebook's Katran looked too scary (and I don't do C++), so I thought I would investigate using XDP/eBPF to redirect packets at high speed and Go to do the control plane work of health-checking backed servers and managing configuration. With luck the resulting binary should be easy to deploy by non-developers. It's still not mature, but seems to work. Code was written in a very exploratory manner, and I'm not a developer so it is quite shocking at the moment, but I aim to improve it. It is intended to be horizontally scalable with ECMP and has been tested on service providing…
2022 · github.com · its alternatives →
7
Wachy – A UI for eBPF-based performance debugging▲116
eBPF is an amazing technology that allows safely running user-supplied functions at pretty much arbitrary probe points in a kernel/user space context. Much has been written about how amazing this feature is for kernel observability. But as someone who writes user space code, what I find even more amazing is the support for tracing arbitrary user space programs, with no code changes and low overhead. However, doing in-depth analysis can get complicated and time-consuming. My goal with wachy was to make this debugging significantly easier/faster to use, by displaying traces in a TUI…
2022 · rubrikinc.github.io · its alternatives →
8
Using eBPF to see through encryption without a proxy▲259
Hi HN, I'm Tyler Flint, one of the creators of qtap. For a while now, my team and I at Qpoint.io have been grappling with the challenge of understanding what's actually happening inside the encrypted traffic leaving our production systems. Modern apps rely heavily on third-party APIs (think payment processors, data providers, etc.), but once TLS kicks in, figuring out exactly what data is being sent, identifying PII exposure, or debugging integration issues becomes incredibly difficult without resorting to complex and often brittle solutions. Traditional approaches like forward proxies…
2025 · github.com · its alternatives →
9
Bor – Open-source policy management for Linux desktops▲197
Hi HN! I've been working on Bor, an open-source system for centralized Linux desktop management. Bor consists of a lightweight Go agent and a central server. Policies are streamed to clients over mTLS/gRPC in real time—no polling—and currently support Firefox, Chrome, KDE, dconf, polkit and package management, with more coming. Version 0.8 introduces several new policy types - Thunderbird, Microsoft Edge for Business and FirewallD zones, along with a number of improvements and fixes. I'd love feedback on the architecture, policy model, and whether this is something you'd consider for…
Aug 2026 · getbor.dev · its alternatives →
10
Knockles – eBPF Port Knocking Tool▲76
eBPF Port Knocking Tool. Contribute to eeriedusk/knockles development by creating an account on GitHub.
2022 · github.com · its alternatives →
11
Cerberus – Real-time network monitor with eBPF▲12
Hi HN! I'm Mo, a platform engineer at Deltaflare working on critical infrastructure protection. I built Cerberus because traditional packet capture tools (tcpdump, Wireshark) have too much overhead for production CNI environments. eBPF lets us filter and classify packets at the kernel level with near-zero performance impact. Some interesting challenges: - eBPF verifier is strict - every memory access needs bounds checking - Limited to 32 bytes of L7 payload (tradeoff between inspection depth and overhead) - TC vs XDP decision (chose TC for compatibility) Looking for contributors, especially…
Dec 2025 · github.com · its alternatives →
12
Trayce – Network tab for Docker containers▲138
Trayce (https://github.com/evanrolfe/trayce_gui) is an open source desktop application which monitors HTTP(S) traffic to Docker containers on your machine. It uses EBPF to achieve zero-configuration sniffing of TLS-encrypted traffic. As a backend developer I wanted something which was similar to Wireshark or the Chrome network tab, but which intercepted requests & responses to my containers for debugging in a local dev environment. Wireshark is a great tool but it seems more geared towards lower level networking tasks. When I'm developing APIs or microservices I dont care…
2024 · trayce.dev · its alternatives →
13
Netfence – Like Envoy for eBPF Filters▲58
To power the firewalling for our agents so that they couldn't contact arbitrary services, I build netfence. It's like Envoy but for eBPF filters. It allows you to define different DNS-based rules that are resolved in a local daemon to IPs, then pushed to the eBPF filter to allow traffic. By doing it this way, we can still allow DNS-defined rules, but prevent contacting random IPs. There's also no network performance penalty, since it's just DNS lookups and eBPF filters referencing memory. It also means you don't have to tamper with the base image, which the agent could potentially manipulate…
Jan 2026 · github.com · its alternatives →
14
eBPF tool to monitor disk usage, perform actions▲22
eBPF based tool to monitor disk usage, perform actions when threshold breached. - Lakshmipathi/ebpf-diskalert
2023 · github.com · its alternatives →
15
Stratoshark, a sibling application to Wireshark▲321
Hi all, I'm excited to announce Stratoshark, a sibling application to Wireshark that lets you capture and analyze process activity (system calls) and log messages in the same way that Wireshark lets you capture and analyze network packets. If you would like to try it out you can download installers for Windows and macOS and source code for all platforms at https://stratoshark.org. AMA: I'm the goofball whose name is at the top of the "About" box in both applications, and I'll be happy to answer any questions you might have.
2025 · stratoshark.org · its alternatives →
16
Lowfat – pluggable CLI filter that saved 91.8% of my LLM tokens▲156
Hi HN, not sure if anyone would be interested, but just wanted to share that I've been maintaining my small tool called 'lowfat' that helps me filters some of my verbose CLI output. It's a single binary, works as an agent hook or a shell wrapper. It has a plugin system to customize filters per command. The idea is pretty simple: agents don't need the full kubectl get -o yaml or any 10k-line dump to make decisions. So that lowfat sits in between, strips the noise, and passes through what matters. Here's my real report after 2 months of personal use: lowfat history --all lowfat plugin…
Jun 2026 · github.com · its alternatives →
17
Lightweight tool for managing Linux virtual machines▲144
hey guys. the other day i was migrating hosting providers and i just needed something not too heavy and convenient to spin up my backups for awhile and realised there is almost nothing out there. kimchi hasn't been updated for years and cockpit is heavy. so here's something i came up with in a couple hours because of a sudden urge, nothing fancy just basic creation with cloud init, lifecycle management and image/storage, but it's modern-ish and it compiles to a 8.4mb binary inclusive of the embedded web UI, CLI and API, and only dep is libvirt.
2025 · github.com · its alternatives →
18
Coroot▲58
An zero-instrumentation observability tool based on eBPF
2023 · github.com · its alternatives →
19
Gecit – DPI bypass using eBPF sock_ops, no proxy or VPN▲9
DPI bypass tool - eBPF on Linux, TUN on macOS/Windows. - boratanrikulu/gecit
Apr 2026 · github.com · its alternatives →
20PI
Pixie, Instant Kubernetes-Native Application Observability Using EBPF▲108
2020 · pixielabs.ai · its alternatives →
21
Linnix – eBPF observability that predicts failures before they happen▲21
I kept missing incidents until it was too late. By the time my monitoring alerted me, servers/nodes were already unrecoverable. So I built Linnix. It watches your Linux systems at the kernel level using eBPF and tries to catch problems before they cascade into outages. The idea is simple: instead of alerting you after your server runs out of memory, it notices when memory allocation patterns look weird and tells you "hey, this looks bad." It uses a local LLM to spot patterns. Not trying to build AGI here - just pattern matching on process behavior. Turns out LLMs are actually pretty…
Nov 2025 · github.com · its alternatives →
22
xstack – Passive eBPF Linux stack profiling without tracepoints▲6
Here's the latest eBPF performance tool of mine - xstack. It's a minimal tool, just 165 lines of eBPF C and under 500 lines of userland C code (including all comments and boilerplate!). It uses the libbpf and (Rust) BlazeSym libraries though (which are a lot of code). The point (and difference) of this tool is that it can sample both the kernel and userspace stack traces of all threads in your system. Traditionally, the "bpf_get_stack()" helper can not read userspace stack traces of other tasks in Linux, but since Linux 5.18 we can combine sleepable eBPF task iterator programs with a new…
2025 · tanelpoder.com · its alternatives →
23
Alaz: Open-Source, Self-Hosted, eBPF-Based K8s Monitoring▲101
Hello Everyone, I'm excited to introduce a new open-source observability platform and would love to hear your feedback. We are aware that there are lots of open-source/commercial tools out there. However, we believe that monitoring the clusters and extracting actionable insights requires deep know-how about the tools/domain. We mainly focused on this problem. - Alaz is an eBPF agent installed on your K8s cluster as DaemonSet. Thanks to eBPF, Alaz collects traces directly from Linux kernels. This means there's no need for sidecars, instrumentations, or service restarts. - The UI not…
2023 · github.com · its alternatives →
24
Dsnitch – Real-time, zero-config Docker egress inspector via eBPF▲5
A single-binary, lightweight, zero-configuration, real-time terminal UI (TUI) network and DNS egress inspector for Docker containers powered by modern Linux eBPF. - infomaniac777/dsnitch
Sep 2026 · github.com · its alternatives →

Also compare

Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →