bpftool(8)
Inspect and manage eBPF programs and maps on the Linux kernel.
Synopsis
bpftool [OPTIONS] OBJECT { COMMAND | help }Description
bpftool is a utility for inspecting, loading, and managing eBPF (extended Berkeley Packet Filter) programs and maps in the Linux kernel. It allows you to examine running eBPF programs, view loaded maps, attach programs to hooks, and debug eBPF code.
The tool operates on objects like prog, map, link, net, and perf. Each object supports subcommands such as list, show, dump, and pin.
Common options
| Flag | What it does |
|---|---|
-j, --json | output results in JSON format for parsing by scripts |
-p, --pretty | pretty-print JSON output with indentation |
-d, --debug | enable debug output |
-m, --mapcompat | activate map name compatibility mode for older kernels |
-n, --nomount | do not mount the bpffs filesystem |
-V, --version | show version information |
Examples
list all loaded eBPF programs with their IDs and names
bpftool prog listdisplay detailed information about eBPF program with ID 42
bpftool prog show id 42show the compiled eBPF bytecode (xlated instructions) for program ID 42
bpftool prog dump xlated id 42list all loaded eBPF maps with their IDs, types, and key/value sizes
bpftool map listdump all key-value entries from the map with ID 5
bpftool map dump id 5load an eBPF program object file and attach it as a kprobe
bpftool prog load /path/to/prog.o type kprobe name my_probelist all kprobe-type programs in JSON format and filter with jq
bpftool -j prog list | jq '.[] | select(.type=="kprobe")'list all active eBPF links (attachments of programs to kernel hooks)
bpftool link list