Live, system-wide USB transfer sniffer in eBPF

What it does

A real-time, colorized feed of USB traffic system-wide — built on the two universal URB chokepoints every host-controller driver funnels through, so it works on xHCI/EHCI/OHCI/dwc alike with no per-controller tracepoints and no usbmon . Fully CO-RE portable. An lru_hash keyed by the URB pointer stitches the two together: submit stamps a start time, completion reads it back for the submit→complete latency, then deletes it. This mirrors httpbody 's request/response pairing — SUBMIT is the "request" (what the host sends), COMPLETE the "response" (what the device returns). Control transfers get their 8-byte SETUP packet decoded into the standard request name ( GET_DESCRIPTOR , SET_CONFIGURATION…from github.com

• 
  Credentials dumper for Linux using eBPF2022 · github.com · ▲235

  Credentials Dumper for Linux using eBPF. Contribute to citronneur/pamspy development by creating an account on GitHub.

• 
  CLI forensics tool for tracking USB device artifacts on Linux2019 · github.com · ▲136

  Tracking history of USB events on GNU/Linux. Contribute to snovvcrash/usbrip development by creating an account on GitHub.

• 
  Bluetooth USB Peripheral Relay – Bridge Bluetooth Devices to USB2024 · github.com · ▲233

  Hi HN! I built Bluetooth USB Peripheral Relay, a tool that lets Bluetooth devices (like keyboards and mice) connect to USB-only hosts using a Raspberry Pi Zero W. Why? My friend needed a way to use his Bluetooth mouse and keyboard on a PC with Bluetooth disabled due to policy restrictions. This tool acts as a bridge, relaying Bluetooth input over USB. It also lets you use Bluetooth peripherals with older devices that only support USB input. Tech: Written in Go, optimized for Raspberry Pi Zero W. I love HN’s community and often lurk here—I’m hoping this project is useful or at least sparks…

• 
  Write your BPF programs in Go, not CMay 2026 · github.com · ▲112

  Write your BPF programs in Go, not C. gobee transpiles a Go subset to BPF C and generates typed cilium/ebpf bindings. - boratanrikulu/gobee

• 
  Trayce – Network tab for Docker containers2024 · trayce.dev · ▲138

  Trayce (https://github.com/evanrolfe/trayce_gui) is an open source desktop application which monitors HTTP(S) traffic to Docker containers on your machine. It uses EBPF to achieve zero-configuration sniffing of TLS-encrypted traffic. As a backend developer I wanted something which was similar to Wireshark or the Chrome network tab, but which intercepted requests & responses to my containers for debugging in a local dev environment. Wireshark is a great tool but it seems more geared towards lower level networking tasks. When I'm developing APIs or microservices I dont care…

• 
  eBPF-powered L4 package dropper2022 · github.com · ▲11

  eBPF/XDP packet filtering for Linux. Contribute to boratanrikulu/durdur development by creating an account on GitHub.

• 
  WallHop – 12ft.io is gone, so I built a replacement▲287

  wallhop is a free paywall bypass. Paste any article link to read it without paywall popups, ads or clutter. No signup, no extension. A simple 12ft.io alternative.

  Growth · 12d ago · wallhop.io

• 
  Prefer▲201

  The execution layer for AEO

  Growth · 24d ago · tryprefer.com

• 
  MakerMap▲197

  A living map of makers and what they’re building

  Growth · 27d ago · makermap.lol

• 
  Brew ▲900

  Like Claude design for email marketing

  AI · May 2026 · brew.new

• 
  Kilo Code for VS Code▲896

  Parallel agents, diff reviewer, and multi-model comparisons

  Dev tools · May 2026 · kilo.ai

• 
  StoreClaw▲806

  Grow your store profits with agents that know how to sell

  AI · May 2026 · storeclaw.ai

• 
  PollyReach▲795

  Give your agent a real number and voice to make calls.

  AI · May 2026 · pollyreach.ai

• 
  Needle: We Distilled Gemini Tool Calling into a 26M Model▲776

  Hey HN, Henry here from Cactus. We open-sourced Needle, a 26M parameter function-calling (tool use) model. It runs at 6000 tok/s prefill and 1200 tok/s decode on consumer devices. We were always frustrated by the little effort made towards building agentic models that run on budget phones, so we conducted investigations that led to an observation: agentic experiences are built upon tool calling, and massive models are overkill for it. Tool calling is fundamentally retrieval-and-assembly (match query to tool name, extract argument values, emit JSON), not reasoning. Cross-attention…

  Life & fun · May 2026 · github.com

• 
  Files.md – Open-source alternative to Obsidian▲730

  🌱 Private, quiet space for thinking. Simple app for .md files. - zakirullin/files.md

  Dev tools · May 2026 · github.com