Dev tools · alternatives · 2026
24 alternatives to Spliff – Correlating XDP and TLS via eBPF (Building a Linux EDR)
eBPF SSL/TLS sniffer correlating XDP and uprobes. Building an open-source Linux-native EDR. - NoFear0411/spliff
Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.
- 1
Credentials Dumper for Linux using eBPF. Contribute to citronneur/pamspy development by creating an account on GitHub.
2022 · github.com · its alternatives →
- 2
Always on Profiling for Production Systems
2024 · 0x.tools · its alternatives →
- 3
eBPF/XDP packet filtering for Linux. Contribute to boratanrikulu/durdur development by creating an account on GitHub.
2022 · github.com · its alternatives →
- 4
Write your BPF programs in Go, not C. gobee transpiles a Go subset to BPF C and generates typed cilium/ebpf bindings. - boratanrikulu/gobee
May 2026 · github.com · its alternatives →
- 5
Linux system exploration and troubleshooting tool with first class support for containers - draios/sysdig
2014 · github.com · its alternatives →
- 6
A common open source approach to observability will begin with databases and visualizations for telemetry - Grafana, Prometheus, Jaeger. But observability doesn’t begin and end here: these tools require configuration, dashboard customization, and may not actually pinpoint the data you need to mitigate system risks. Coroot was designed to solve the problem of manual, time-consuming observability analysis: it handles the full observability journey — from collecting telemetry to turning it into actionable insights. We also strongly believe that simple observability should be an innovation…
2025 · github.com · its alternatives →
- 7
Tracking history of USB events on GNU/Linux. Contribute to snovvcrash/usbrip development by creating an account on GitHub.
2019 · github.com · its alternatives →
- 8
Open source APM: OpenTelemetry traces, metrics, and logs - uptrace/uptrace
2021 · github.com · its alternatives →
- 9
A desktop client for SSH, SFTP, Docker over SSH
24d ago · github.com · its alternatives →
- 10
Implementation of the standard is still not complete, but breakpoints and stepping work quite well! It also has some support for watchpoints, that no implementation has. Now it ships with ASDF and is capable of loading systems! Let me know if you like it. Support on Patreon or Liberapay is much appreciated
2025 · savannah.nongnu.org · its alternatives →
- 11
eBPF-based Linux kernel guard that lets only allowlisted binaries use the TPM. - bschaatsbergen/tpmlsm
19d ago · github.com · its alternatives →
- 12
An Erlang library for generating adversarial network conditions for QAing distributed applications/systems on a single Linux box. - lostcolony/damocles
2015 · github.com · its alternatives →
- 13
An experimental high-performance DNS query bruteforce tool built with AF_XDP for extremely fast and accurate bulk DNS lookups. - c3l3si4n/pugdns
2025 · github.com · its alternatives →
- 14
Facebook's Katran looked too scary (and I don't do C++), so I thought I would investigate using XDP/eBPF to redirect packets at high speed and Go to do the control plane work of health-checking backed servers and managing configuration. With luck the resulting binary should be easy to deploy by non-developers. It's still not mature, but seems to work. Code was written in a very exploratory manner, and I'm not a developer so it is quite shocking at the moment, but I aim to improve it. It is intended to be horizontally scalable with ECMP and has been tested on service providing…
2022 · github.com · its alternatives →
- 15
Live, system-wide USB transfer sniffer in eBPF — decodes USB traffic inline (control SETUP, SCSI, HID) from two universal URB hooks. No usbmon, no hardware sniffer. CO-RE portable. - yeet-src/usbsnoop
May 2026 · github.com · its alternatives →
- 16
Behavioral hidden-cryptominer detector for Linux in eBPF — flags processes talking to mining-pool ports while spoofing kernel-thread names. No signatures, no agent, no cloud. CO-RE portable. - yeet-src/poolnarc
Jun 2026 · github.com · its alternatives →
- 17
Nyxelf simplifies static and dynamic analysis of ELF binaries, enabling you to extract valuable insights effortlessly. And can be used for vulnerability assessments, unpacking, syscall tracing, and memory analysis.
2025 · github.com · its alternatives →
- 18
Coroot▲58An zero-instrumentation observability tool based on eBPF
2023 · github.com · its alternatives →
- 19
Hi HN! We’re Ethan and Danny, the authors of Tangent (https://github.com/telophasehq/tangent), a Rust-based log pipeline where all normalization, enrichment, and detection logic runs as WASM plugins. We kept seeing the same problems in the OCSF (https://ocsf.io) community: 1) Schemas change constantly. Large companies have whole teams dedicated to keeping vendor→OCSF mappings up to date. 2) There’s no shared library of mappings, so everyone recreates the same work. 3) Writing mappers is tedious, repetitive work. 4) Most pipelines use proprietary DSLs that are…
Nov 2025 · github.com · its alternatives →
- 20
Windows Storage Proxy Driver - User mode disk storage - winfsp/winspd
2019 · github.com · its alternatives →
- 21
Binary delta encoding tools. Contribute to eerimoq/detools development by creating an account on GitHub.
2020 · github.com · its alternatives →
- 22
DPI bypass tool - eBPF on Linux, TUN on macOS/Windows. - boratanrikulu/gecit
Apr 2026 · github.com · its alternatives →
- 23
2017 · github.com · its alternatives →
- 24
Trace Go program execution with uprobes and eBPF. Contribute to grantseltzer/weaver development by creating an account on GitHub.
2020 · github.com · its alternatives →
Also compare
- Credentials dumper for Linux using eBPF alternatives
- Xcapture-BPF – like Linux top, but with Xray vision alternatives
- eBPF-powered L4 package dropper alternatives
- Write your BPF programs in Go, not C alternatives
- Sysdig, a tool for Linux system exploration alternatives
- Coroot – eBPF-based, open source observability with actionable insights alternatives
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →