// In eBPF program (kernel side)
struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __uint(max_entries, 10000);
    __type(key, __u32);       // IPv4 address
    __type(value, __u64);     // packet count
} pkt_count SEC(".maps");
 
// Lookup
__u64 *count = bpf_map_lookup_elem(&pkt_count, &src_ip);
 
// Update
__u64 new_count = (count ? *count : 0) + 1;
bpf_map_update_elem(&pkt_count, &src_ip, &new_count, BPF_ANY);
 
// Delete
bpf_map_delete_elem(&pkt_count, &src_ip);
 
// Atomic increment (per-CPU safe)
__sync_fetch_and_add(count, 1);

from bcc import BPF
 
b = BPF(src_file="program.c")
pkt_count = b["pkt_count"]
 
# Read all entries
for ip, count in pkt_count.items():
    print(f"IP: {socket.inet_ntoa(ip)} → {count.value} packets")

struct event {
    __u32 pid;
    char comm[16];
    __u64 bytes;
};
 
struct {
    __uint(type, BPF_MAP_TYPE_RINGBUF);
    __uint(max_entries, 1 << 24);  // 16MB
} events SEC(".maps");
 
// Reserve and submit event
struct event *e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
if (!e) return 0;
 
e->pid = bpf_get_current_pid_tgid() >> 32;
bpf_get_current_comm(&e->comm, sizeof(e->comm));
e->bytes = bytes;
 
bpf_ringbuf_submit(e, 0);

SEC("kprobe/do_sys_openat2")
int BPF_KPROBE(trace_openat, int dfd, const char __user *filename, 
               struct open_how *how)
{
    char fname[256];
    bpf_probe_read_user_str(fname, sizeof(fname), filename);
    
    bpf_printk("openat: %s\n", fname);
    return 0;
}

ls /sys/kernel/debug/tracing/events/syscalls/
ls /sys/kernel/debug/tracing/events/sched/
ls /sys/kernel/debug/tracing/events/net/

SEC("tp/sched/sched_process_exec")
int trace_exec(struct trace_event_raw_sched_process_exec *ctx)
{
    char comm[16];
    bpf_probe_read_kernel_str(comm, sizeof(comm), ctx->filename);
    
    __u32 pid = bpf_get_current_pid_tgid() >> 32;
    bpf_printk("exec: pid=%d file=%s\n", pid, comm);
    return 0;
}

SEC("uprobe//usr/lib/libssl.so:SSL_read")
int BPF_UPROBE(trace_ssl_read, void *ssl, void *buf, int num)
{
    char data[256];
    bpf_probe_read_user(data, sizeof(data), buf);
    bpf_printk("SSL_read: %s\n", data);
    return 0;
}

SEC("xdp")
int xdp_firewall(struct xdp_md *ctx)
{
    void *data     = (void *)(long)ctx->data;
    void *data_end = (void *)(long)ctx->data_end;
    
    struct ethhdr *eth = data;
    if ((void *)(eth + 1) > data_end) return XDP_PASS;
    if (eth->h_proto != bpf_htons(ETH_P_IP)) return XDP_PASS;
    
    struct iphdr *ip = (void *)(eth + 1);
    if ((void *)(ip + 1) > data_end) return XDP_PASS;
    
    // Check blacklist map
    __u32 src = ip->saddr;
    __u32 *blocked = bpf_map_lookup_elem(&blacklist, &src);
    if (blocked) return XDP_DROP;  // Line-rate drop!
    
    return XDP_PASS;
}

SEC("tc")
int tc_egress(struct __sk_buff *skb)
{
    void *data     = (void *)(long)skb->data;
    void *data_end = (void *)(long)skb->data_end;
    
    struct iphdr *ip = data + sizeof(struct ethhdr);
    if ((void *)(ip + 1) > data_end) return TC_ACT_OK;
    
    // Mark packet for DSCP QoS
    ip->tos = (ip->tos & 0x03) | (46 << 2);  // EF PHB
    return TC_ACT_OK;
}

# On target machine
bpftool btf dump file /sys/kernel/btf/vmlinux format c > vmlinux.h

// Safe CO-RE field access — handles struct layout differences
#include "vmlinux.h"
#include <bpf/bpf_core_read.h>
 
SEC("kprobe/tcp_v4_connect")
int trace_connect(struct pt_regs *ctx)
{
    struct sock *sk = (struct sock *)PT_REGS_PARM1(ctx);
    
    // CO-RE safe read — works across kernel versions
    __u16 dport = BPF_CORE_READ(sk, __sk_common.skc_dport);
    __u32 daddr = BPF_CORE_READ(sk, __sk_common.skc_daddr);
    
    bpf_printk("tcp_connect: %x:%d\n", daddr, bpf_ntohs(dport));
    return 0;
}

project/
├── vmlinux.h          # auto-generated kernel types
├── program.bpf.c      # eBPF kernel-side code
├── program.c          # user-space loader + consumer
└── Makefile

# Install dependencies
sudo apt install clang llvm libbpf-dev linux-headers-$(uname -r)
 
# Compile eBPF program
clang -g -O2 -target bpf -D__TARGET_ARCH_x86 \
      -I/usr/include/x86_64-linux-gnu \
      -c program.bpf.c -o program.bpf.o
 
# Generate skeleton header
bpftool gen skeleton program.bpf.o > program.skel.h
 
# Compile user space
gcc -o program program.c -lbpf

from bcc import BPF
 
prog = r"""
#include <uapi/linux/ptrace.h>
#include <linux/sched.h>
 
BPF_PERF_OUTPUT(events);
 
struct data_t {
    u32  pid;
    char comm[TASK_COMM_LEN];
    char filename[256];
};
 
TRACEPOINT_PROBE(syscalls, sys_enter_execve) {
    struct data_t data = {};
    data.pid = bpf_get_current_pid_tgid() >> 32;
    bpf_get_current_comm(&data.comm, sizeof(data.comm));
    bpf_probe_read_user_str(data.filename, sizeof(data.filename), args->filename);
    events.perf_submit(args, &data, sizeof(data));
    return 0;
}
"""
 
b = BPF(text=prog)
 
def print_event(cpu, data, size):
    event = b["events"].event(data)
    print(f"[{event.pid:6}] {event.comm.decode():20} exec: {event.filename.decode()}")
 
b["events"].open_perf_buffer(print_event)
 
print("Tracing execve... Ctrl+C to stop.")
while True:
    b.perf_buffer_poll()

# Trace all execve syscalls
bpftrace -e 'tracepoint:syscalls:sys_enter_execve { printf("%s execve %s\n", comm, str(args->filename)); }'
 
# Count syscalls per process
bpftrace -e 'tracepoint:raw_syscalls:sys_enter { @[comm] = count(); }'
 
# Histogram of read() sizes
bpftrace -e 'tracepoint:syscalls:sys_exit_read /retval > 0/ { @bytes = hist(retval); }'
 
# Disk I/O latency histogram
bpftrace -e 'kprobe:blk_account_io_start { @start[arg0] = nsecs; }
kprobe:blk_account_io_done /@start[arg0]/ {
    @lat = hist((nsecs - @start[arg0]) / 1000);
    delete(@start[arg0]);
}'
 
# CPU profiling — stack traces every 99Hz
bpftrace -e 'profile:hz:99 { @[kstack] = count(); }'
 
# TCP connection tracking
bpftrace -e 'kprobe:tcp_v4_connect { printf("connect: %s → %s\n", comm, ntop(arg1)); }'
 
# Trace SSL/TLS plaintext (no app modification)
bpftrace -e 'uprobe:/usr/lib/libssl.so:SSL_write { printf("SSL write: %s\n", str(arg1)); }'
 
# Memory allocation tracking
bpftrace -e 'uprobe:/usr/lib/libc.so:malloc { @allocs[comm] = sum(arg0); }'

# Install FlameGraph tools
git clone https://github.com/brendangregg/FlameGraph
 
# Profile for 30 seconds
bpftrace -e 'profile:hz:99 { @[kstack, ustack] = count(); }' \
    --no-warnings > /tmp/out.txt 30
 
# Or use perf with BPF backend
perf record -F 99 -a -g -- sleep 30
perf script | stackcollapse-perf.pl | flamegraph.pl > flame.svg

# TCP connections with latency
bpftrace -e '
kprobe:tcp_v4_connect { @start[tid] = nsecs; }
kretprobe:tcp_v4_connect /@start[tid]/ {
    printf("tcp_connect latency: %d us\n", (nsecs - @start[tid]) / 1000);
    delete(@start[tid]);
}'
 
# Top TCP talkers by bytes
bpftrace -e '
kprobe:tcp_sendmsg { @bytes[comm] += arg2; }
interval:s:5 { print(@bytes); clear(@bytes); }'

SEC("lsm/file_open")
int BPF_PROG(restrict_file_open, struct file *file)
{
    char comm[16];
    bpf_get_current_comm(comm, sizeof(comm));
    
    // Block "bad_proc" from opening /etc/passwd
    if (__builtin_memcmp(comm, "bad_proc", 8) == 0) {
        char filename[64];
        bpf_probe_read_kernel_str(filename, sizeof(filename),
                                 file->f_path.dentry->d_name.name);
        if (__builtin_memcmp(filename, "passwd", 6) == 0)
            return -EPERM;  // Deny access
    }
    return 0;
}

#include <linux/seccomp.h>
#include <linux/filter.h>
#include <sys/prctl.h>
 
struct sock_filter filter[] = {
    // Load syscall number
    BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),
    // Allow read, write, exit
    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_read,  2, 0),
    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_write, 1, 0),
    // Kill process on anything else
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL),
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
};
 
prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);

# List loaded BPF programs
bpftool prog list
bpftool prog show id 42
 
# Dump BPF program bytecode
bpftool prog dump xlated id 42
bpftool prog dump jited id 42      # JIT-compiled native code
 
# List all BPF maps
bpftool map list
bpftool map show id 10
bpftool map dump id 10             # dump all map entries
 
# Lookup map entry
bpftool map lookup id 10 key 01 00 00 00
 
# Update map entry
bpftool map update id 10 key 01 00 00 00 value 01 00 00 00
 
# Show BTF types
bpftool btf list
bpftool btf dump id 1
 
# Pin/unpin programs to filesystem
bpftool prog pin id 42 /sys/fs/bpf/my_program
 
# Generate skeleton
bpftool gen skeleton program.bpf.o > program.skel.h
 
# Show BPF network attachments
bpftool net list
 
# Profile BPF program performance
bpftool prog profile id 42 duration 5 cycles instructions l1dcache-misses