bpftool

Inspect and manage eBPF programs and maps.

TLDR

Show every eBPF program currently loaded

$ bpftool prog show

Emit pretty-printed JSON for scripting

$ bpftool -p prog show

Disassemble a program's verifier-translated instructions

$ bpftool prog dump xlated id [42]

Disassemble the JIT-compiled machine code

$ bpftool prog dump jited id [42]

Show the loaded maps

$ bpftool map show

Dump the key/value contents of one map

$ bpftool map dump id [17]

Show programs attached to network interfaces

$ bpftool net show

Show cgroup attachments as a tree

$ bpftool cgroup tree

Show the loaded BPF Type Format objects

$ bpftool btf show

Print the type information carried by one BTF object

$ bpftool btf dump id [3]

Pin a program to the bpf filesystem so it outlives its loader

$ bpftool prog pin id [42] /sys/fs/bpf/[myprog]

Report which eBPF features the running kernel supports

$ bpftool feature probe kernel

SYNOPSIS

bpftool [object] command [options]

bpftool inspects and manipulates eBPF (extended Berkeley Packet Filter) programs and maps. It provides visibility into loaded BPF programs, their attachments, and the data structures they use.eBPF is a powerful Linux kernel technology used for networking, security, tracing, and performance analysis. bpftool is essential for debugging and managing eBPF-based tools.

OPTIONS

-j, --json

Generate JSON output.

-p, --pretty

Generate human-readable JSON output (implies -j).

-d, --debug

Print libbpf debug messages to stderr.

-f, --bpffs

When showing programs, show file names of pinned objects.

-V, --version

Print version number and supported features.

OBJECTS

prog

Manage BPF programs

map

Manage BPF maps

link

Manage BPF links

net

Inspect network-related BPF attachments

perf

Inspect perf-related BPF attachments

btf

Manage BTF (BPF Type Format) data

cgroup

Show, attach, and detach BPF programs on cgroups

feature

Probe kernel/device for BPF feature support

gen

Generate skeleton C header files and BTF data from object files

struct_ops

Register, unregister, and introspect BPF struct_ops

iter

Create and pin BPF iterators

INSTALL

sudo apt install bpftool

sudo dnf install bpftool

sudo apk add bpftool

sudo zypper install bpftool

CAVEATS

Requires root privileges or CAP_BPF capability. Output format may vary between kernel versions. Some features require specific kernel configuration options.

HISTORY

bpftool is developed in the Linux kernel source tree under tools/bpf/bpftool and ships with the kernel. It is periodically synced to a stand-alone build mirror maintained by the libbpf project, which packages it independently of the full kernel tree.

RESOURCES

Source code · Documentation