{"id":15190169,"url":"https://github.com/yuuki/go-conntracer-bpf","last_synced_at":"2025-10-27T13:30:33.367Z","repository":{"id":53183409,"uuid":"324173131","full_name":"yuuki/go-conntracer-bpf","owner":"yuuki","description":"Go library using eBPF to trace network flow events","archived":false,"fork":false,"pushed_at":"2021-04-19T07:18:40.000Z","size":9369,"stargazers_count":34,"open_issues_count":2,"forks_count":2,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-02-01T05:41:20.489Z","etag":null,"topics":["bpf","cgo","ebpf","go","golang","kprobe","libbpf","tcp","tracing","udp"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/yuuki.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-12-24T14:24:03.000Z","updated_at":"2024-06-14T17:05:33.000Z","dependencies_parsed_at":"2022-08-22T20:01:08.418Z","dependency_job_id":null,"html_url":"https://github.com/yuuki/go-conntracer-bpf","commit_stats":null,"previous_names":["yuuki/gobpflib-conntracer","yuuki/gobpf-conntracer"],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yuuki%2Fgo-conntracer-bpf","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yuuki%2Fgo-conntracer-bpf/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yuuki%2Fgo-conntracer-bpf/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yuuki%2Fgo-conntracer-bpf/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/yuuki","download_url":"https://codeload.github.com/yuuki/go-conntracer-bpf/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":238497657,"owners_count":19482295,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bpf","cgo","ebpf","go","golang","kprobe","libbpf","tcp","tracing","udp"],"created_at":"2024-09-27T20:05:34.158Z","updated_at":"2025-10-27T13:30:27.528Z","avatar_url":"https://github.com/yuuki.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# go-conntracer-bpf\n\n[![Go Reference](https://pkg.go.dev/badge/github.com/yuuki/go-conntracer-bpf.svg)](https://pkg.go.dev/github.com/yuuki/go-conntracer-bpf)\n\ngo-conntracer-bpf is a library for Go for tracing network connection (TCP/UDP) events (connect, accept, sendto, recvfrom) on BPF kprobe inspired by [weaveworks/tcptracer-bpf](https://github.com/weaveworks/tcptracer-bpf). go-conntracer-bpf is implemented on top of [libbpf](https://github.com/libbpf/libbpf), which is a representative C library for BPF included Linux kernel.\n\n## Features\n\n- Low-overhead tracing by aggregating connection events in kernel.\n- BPF CO-RE (Compile Once – Run Everywhere)-enabled\n\n![Flow events aggregation in kernel](./docs/images/aggregation.png \"aggregation\")\n\n## Prerequisites\n\n### Compilation phase\n\n- libbpf source code\n- Clang/LLVM \u003e= 9\n\n### Runtime phase\n\n- Linux kernel version \u003e= 5.6 (due to batch ops to bpf maps)\n- Linux kernel to be built with BTF type information. See \u003chttps://github.com/libbpf/libbpf#bpf-co-re-compile-once--run-everywhere\u003e.\n\n### Common to both phase\n\n- libelf and zlib libraries\n\n## Features of Linux kernel included in go-conntracer-bpf\n\ngo-conntracer-bpf makes use of some latest features of Linux kernel.\n\n- BPF Type Format (BTF)\tin kernel version 4.18.\n- Batch API to BPF map (BPF_MAP_UPDATE_BATCH, BPF_MAP_LOOKUP_AND_DELETE_BATCH) in kernel version 5.6.\n- Ring Buffer in kernel version 5.8 (only a flavor of no-aggregation in kernel).\n\n## Usage\n\n- [godoc](https://godoc.org/github.com/yuuki/go-conntracer-bpf)\n\n## conntop\n\nconntop is a CLI tool to show connection events.\n\n### Build conntop\n\n```shell-session\n$ make DOCKER=1\n```\n\n## Projects using go-conntracer-bpf\n\n- [yuuki/shawk](https://github.com/yuuki/shawk)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fyuuki%2Fgo-conntracer-bpf","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fyuuki%2Fgo-conntracer-bpf","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fyuuki%2Fgo-conntracer-bpf/lists"}