bpftool

bpftool [object] command [options]

bpftool inspects and manipulates eBPF (extended Berkeley Packet Filter) programs and maps. It provides visibility into loaded BPF programs, their attachments, and the data structures they use.eBPF is a powerful Linux kernel technology used for networking, security, tracing, and performance analysis. bpftool is essential for debugging and managing eBPF-based tools.

-j, --json

Generate JSON output.

Generate human-readable JSON output (implies -j).

Print libbpf debug messages to stderr.

When showing programs, show file names of pinned objects.

Print version number and supported features.

prog

Manage BPF programs

Manage BPF maps

Manage BPF links

Inspect network-related BPF attachments

Inspect perf-related BPF attachments

Manage BTF (BPF Type Format) data

Show, attach, and detach BPF programs on cgroups

Probe kernel/device for BPF feature support

Generate skeleton C header files and BTF data from object files

Register, unregister, and introspect BPF struct_ops

Create and pin BPF iterators

Requires root privileges or CAP_BPF capability. Output format may vary between kernel versions. Some features require specific kernel configuration options.

bpftool is developed in the Linux kernel source tree under tools/bpf/bpftool and ships with the kernel. It is periodically synced to a stand-alone build mirror maintained by the libbpf project, which packages it independently of the full kernel tree.

bpftrace(8), tc(8), perf(1)

Source code · Documentation