AI Knowledge Hubbpftool — eBPF program and map management
💬 "bpftool Command"
bpftool is used for eBPF program and map management. It queries and manages eBPF programs, maps, and links. It is used when you need to dive deeper into the results produced by bpftrace.
It queries the list and details of running eBPF programs. It dumps the contents of eBPF maps in real-time.
- Concept: Queries the list and details of running eBPF programs.
- Main Features: Dumps the contents of eBPF maps in real-time.
- Advantages: Checks XDP/TC programs per network interface.
- Usage: Explores the kernel BTF (BPF Type Format).
Installation and Download
bpftool is installed via a package manager or the official script.
| Environment | Command |
|---|---|
| Built-in linux-tools | sudo apt install linux-tools-$(uname -r) |
| RHEL | sudo dnf install bpftool |
| Build from source | github.com/libbpf/bpftool |
| Verify | bpftool version |
Verify the installation with bpftool --version.
Frequently Used Options
| Option | Description |
|---|---|
| bpftool prog list | List running eBPF programs |
| bpftool prog show <id> | Show details for a specific program |
| bpftool map list | List eBPF maps |
| bpftool map dump <id> | Dump map contents |
| bpftool net show | Show BPF programs per interface |
3 Essential Command Combinations
bpftool prog list— Check running eBPF programsbpftool map dump name my_map— Check contents of a specific mapbpftool net show— Check interfaces with attached XDP/TC programs
💬 "Show me an example of using bpftool on a real server"
Here is a step-by-step guide for common situations encountered on live production servers.
Step 1 · Verify Installation
Check if it is installed.
bpftool version || sudo apt install -y linux-tools-$(uname -r)
Step 2 · Program List
Check running eBPF programs.
sudo bpftool prog list
Step 3 · Map Query
Check eBPF map contents.
sudo bpftool map list
Actual Execution Output
This is the result of checking the attachment status of an XDP program using bpftool.
!bpftool command execution results
Live Production Server
How It's Used in Practice
1. Checking XDP Programs
Situation — Verify if the XDP filter is properly attached.
sudo bpftool net show
Result — prog_xdp_filter is visible on eth0.
Key Point — Directly verify the attachment status of the XDP program.
2. Querying Map Contents
Situation — Check a dynamically managed IP whitelist.
sudo bpftool map dump name blocklist
Result — The list of registered IPs is displayed.
Key Point — Verify data synchronization between the kernel and user space.
Actual Execution Output
This is the result of querying map contents using bpftool map dump.
!bpftool command execution results 2
Live Production Server
Important Notes
- bpftool requires root privileges. Map dumps may contain sensitive connection information.
- The output format may vary slightly depending on the kernel version. It is recommended to use the latest bpftool.
- Programs created with bpftrace are cleaned up on exit. To view them with bpftool, query while bpftrace is running.
Source (HTML): https://games.aidebatehub.com/programs/linux/troubleshooting/bpftool.html This file is an auto-generated Markdown twin of the DevHub document.
Visitor Comments