examples/

Details

Valid go.mod file

The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
Redistributable license

Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
Tagged version

Modules with tagged versions give importers more predictable builds.
Stable version

When a project reaches major version v1 it is considered stable.
Learn more about best practices

Kprobe - Attach a program to the entry or exit of an arbitrary kernel symbol (function).
- kprobe - Kprobe using bpf2go.
- kprobepin - Reuse a pinned map for the kprobe example. It assumes the BPF FS is mounted at /sys/fs/bpf.
- kprobe_percpu - Use a BPF_MAP_TYPE_PERCPU_ARRAY map.
- ringbuffer - Use a BPF_MAP_TYPE_RINGBUF map.
Uprobe - Attach a program to the entry or exit of an arbitrary userspace binary symbol (function).
- uretprobe - Uretprobe using bpf2go.
Tracepoint - Attach a program to predetermined kernel tracepoints.
- tracepoint_in_c - Tracepoint using bpf2go.
- tracepoint_in_go - Tracepoint using the ebpf.NewProgram API and Go eBPF assembler.
Cgroup - Attach a program to control groups (cgroups).
- cgroup_skb - Count packets egressing the current cgroup.
Fentry - Attach a program to the entrypoint of a kernel function. Like kprobes, but with better performance and usability, for kernels 5.5 and later.
- tcp_connect - Trace outgoing IPv4 TCP connections.
- tcp_close - Log RTT of IPv4 TCP connections using eBPF CO-RE helpers.
XDP - Attach a program to a network interface to process incoming packets.
- xdp - Print packet counts by IPv4 source address.
Add your use case(s) here!

cd ebpf/examples/
go run -exec sudo [./kprobe, ./uretprobe, ./ringbuffer, ...]

The examples are built via go generate invoked by the Makefile in the project root.

make -C ../

Path	Synopsis
cgroup_skb This program demonstrates attaching an eBPF program to a control group.	This program demonstrates attaching an eBPF program to a control group.
fentry
kprobe This program demonstrates attaching an eBPF program to a kernel symbol.	This program demonstrates attaching an eBPF program to a kernel symbol.
kprobe_percpu This program demonstrates attaching an eBPF program to a kernel symbol and using percpu map to collect data.	This program demonstrates attaching an eBPF program to a kernel symbol and using percpu map to collect data.
kprobepin This program demonstrates attaching an eBPF program to a kernel symbol.	This program demonstrates attaching an eBPF program to a kernel symbol.
map_in_map An example of using maps within maps.	An example of using maps within maps.
ringbuffer
tcprtt
tcprtt_sockops
tracepoint_in_c This program demonstrates attaching an eBPF program to a kernel tracepoint.	This program demonstrates attaching an eBPF program to a kernel tracepoint.
tracepoint_in_go This program demonstrates how to attach an eBPF program to a tracepoint.	This program demonstrates how to attach an eBPF program to a tracepoint.
uretprobe
xdp This program demonstrates attaching an eBPF program to a network interface with XDP (eXpress Data Path).	This program demonstrates attaching an eBPF program to a network interface with XDP (eXpress Data Path).