Growth · alternatives · 2026
24 alternatives to Live, system-wide USB transfer sniffer in eBPF
Live, system-wide USB transfer sniffer in eBPF — decodes USB traffic inline (control SETUP, SCSI, HID) from two universal URB hooks. No usbmon, no hardware sniffer. CO-RE portable. - yeet-src/usbsnoop
Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.
- 1
Credentials Dumper for Linux using eBPF. Contribute to citronneur/pamspy development by creating an account on GitHub.
2022 · github.com · its alternatives →
- 2
Tracking history of USB events on GNU/Linux. Contribute to snovvcrash/usbrip development by creating an account on GitHub.
2019 · github.com · its alternatives →
- 3
Hi HN! I built Bluetooth USB Peripheral Relay, a tool that lets Bluetooth devices (like keyboards and mice) connect to USB-only hosts using a Raspberry Pi Zero W. Why? My friend needed a way to use his Bluetooth mouse and keyboard on a PC with Bluetooth disabled due to policy restrictions. This tool acts as a bridge, relaying Bluetooth input over USB. It also lets you use Bluetooth peripherals with older devices that only support USB input. Tech: Written in Go, optimized for Raspberry Pi Zero W. I love HN’s community and often lurk here—I’m hoping this project is useful or at least sparks…
2024 · github.com · its alternatives →
- 4
Write your BPF programs in Go, not C. gobee transpiles a Go subset to BPF C and generates typed cilium/ebpf bindings. - boratanrikulu/gobee
May 2026 · github.com · its alternatives →
- 5
- 6
Trayce (https://github.com/evanrolfe/trayce_gui) is an open source desktop application which monitors HTTP(S) traffic to Docker containers on your machine. It uses EBPF to achieve zero-configuration sniffing of TLS-encrypted traffic. As a backend developer I wanted something which was similar to Wireshark or the Chrome network tab, but which intercepted requests & responses to my containers for debugging in a local dev environment. Wireshark is a great tool but it seems more geared towards lower level networking tasks. When I'm developing APIs or microservices I dont care…
2024 · trayce.dev · its alternatives →
- 7
Hi HN, I'm Tyler Flint, one of the creators of qtap. For a while now, my team and I at Qpoint.io have been grappling with the challenge of understanding what's actually happening inside the encrypted traffic leaving our production systems. Modern apps rely heavily on third-party APIs (think payment processors, data providers, etc.), but once TLS kicks in, figuring out exactly what data is being sent, identifying PII exposure, or debugging integration issues becomes incredibly difficult without resorting to complex and often brittle solutions. Traditional approaches like forward proxies…
2025 · github.com · its alternatives →
- 8
eBPF/XDP packet filtering for Linux. Contribute to boratanrikulu/durdur development by creating an account on GitHub.
2022 · github.com · its alternatives →
- 9
Hi HN! I'm Mo, a platform engineer at Deltaflare working on critical infrastructure protection. I built Cerberus because traditional packet capture tools (tcpdump, Wireshark) have too much overhead for production CNI environments. eBPF lets us filter and classify packets at the kernel level with near-zero performance impact. Some interesting challenges: - eBPF verifier is strict - every memory access needs bounds checking - Limited to 32 bytes of L7 payload (tradeoff between inspection depth and overhead) - TC vs XDP decision (chose TC for compatibility) Looking for contributors, especially…
Dec 2025 · github.com · its alternatives →
- 10
Hi all, I'm excited to announce Stratoshark, a sibling application to Wireshark that lets you capture and analyze process activity (system calls) and log messages in the same way that Wireshark lets you capture and analyze network packets. If you would like to try it out you can download installers for Windows and macOS and source code for all platforms at https://stratoshark.org. AMA: I'm the goofball whose name is at the top of the "About" box in both applications, and I'll be happy to answer any questions you might have.
2025 · stratoshark.org · its alternatives →
- 11
eBPF is an amazing technology that allows safely running user-supplied functions at pretty much arbitrary probe points in a kernel/user space context. Much has been written about how amazing this feature is for kernel observability. But as someone who writes user space code, what I find even more amazing is the support for tracing arbitrary user space programs, with no code changes and low overhead. However, doing in-depth analysis can get complicated and time-consuming. My goal with wachy was to make this debugging significantly easier/faster to use, by displaying traces in a TUI…
2022 · rubrikinc.github.io · its alternatives →
- 12
Hello Everyone, I'm excited to introduce a new open-source observability platform and would love to hear your feedback. We are aware that there are lots of open-source/commercial tools out there. However, we believe that monitoring the clusters and extracting actionable insights requires deep know-how about the tools/domain. We mainly focused on this problem. - Alaz is an eBPF agent installed on your K8s cluster as DaemonSet. Thanks to eBPF, Alaz collects traces directly from Linux kernels. This means there's no need for sidecars, instrumentations, or service restarts. - The UI not…
2023 · github.com · its alternatives →
- 13
An eBPF tool monitoring a goroutine. Contribute to keisku/gmon development by creating an account on GitHub.
2024 · github.com · its alternatives →
- 14TS
2016 · sc4.us · its alternatives →
- 15
Turn USB captures into readable debugging sessions
Jun 2026 · hannes-software.com · its alternatives →
- 16
A fast SOCKS5 proxy that tunnels your traffic through what looks like normal SMTP email, bypassing Deep Packet Inspection firewalls. How it works: - Client runs a local SOCKS5 proxy (127.0.0.1:1080) - Traffic is sent to server disguised as SMTP (EHLO, STARTTLS, AUTH) - DPI sees legitimate email session, not a VPN/proxy Features: - One-liner install on any Linux VPS - Multi-user with per-user secrets and IP whitelists - Auto-generated client packages (just double-click to run) - Auto-reconnect on connection loss - Works with any app that supports SOCKS5 Tech: Python/asyncio, TLS…
Jan 2026 · github.com · its alternatives →
- 17
HookBox▲120Debugging webhooks and transactional emails can be slow and usually requires multiple tools. I built HookBox to solve this problem, providing instant endpoints, temporary inboxes, real-time capture, and request replay so both can be tested in one place. Would love to hear your feedback! — Egret
2025 · hookbox.app · its alternatives →
- 18
A Virtual FIDO2 USB Device. Contribute to bulwarkid/virtual-fido development by creating an account on GitHub.
2022 · github.com · its alternatives →
- 19
DPI bypass tool - eBPF on Linux, TUN on macOS/Windows. - boratanrikulu/gecit
Apr 2026 · github.com · its alternatives →
- 20
Per-executable network bandwidth monitoring for Linux
2022 · elesiuta.github.io · its alternatives →
- 21
Windows Storage Proxy Driver - User mode disk storage - winfsp/winspd
2019 · github.com · its alternatives →
- 22
eBPF based tool to monitor disk usage, perform actions when threshold breached. - Lakshmipathi/ebpf-diskalert
2023 · github.com · its alternatives →
- 23
eBPF SSL/TLS sniffer correlating XDP and uprobes. Building an open-source Linux-native EDR. - NoFear0411/spliff
Jan 2026 · github.com · its alternatives →
- 24
OnlyKey DUO▲88Open source Yubikey alternative with dual USB-C and USB-A
2021 · onlykey.io · its alternatives →
Also compare
- Credentials dumper for Linux using eBPF alternatives
- CLI forensics tool for tracking USB device artifacts on Linux alternatives
- Bluetooth USB Peripheral Relay – Bridge Bluetooth Devices to USB alternatives
- Write your BPF programs in Go, not C alternatives
- USB Killer alternatives
- Trayce – Network tab for Docker containers alternatives
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →