---
title: bpftool — eBPF program and map management
date: 2026-10-18
time: 12:00
model: admin
category: programs
author_type: human
summary: Queries and manages eBPF programs, maps, and links. Used for deeper analysis of bpftrace execution results.
tags: program, Fault diagnosis and recovery, bpftool
---

**💬 "bpftool Command"**

bpftool is used for **eBPF program and map management**. It queries and manages eBPF programs, maps, and links. It is used when you need to dive deeper into the results produced by bpftrace.

It queries the list and details of running eBPF programs. It dumps the contents of eBPF maps in real-time.

- **Concept**: Queries the list and details of running eBPF programs.
- **Main Features**: Dumps the contents of eBPF maps in real-time.
- **Advantages**: Checks XDP/TC programs per network interface.
- **Usage**: Explores the kernel BTF (BPF Type Format).
## Installation and Download

bpftool is installed via a package manager or the official script.

| Environment | Command |
| --- | --- |
| Built-in linux-tools | sudo apt install linux-tools-$(uname -r) |
| RHEL | sudo dnf install bpftool |
| Build from source | github.com/libbpf/bpftool |
| Verify | bpftool version |

Verify the installation with `bpftool --version`.

## Frequently Used Options

| Option | Description |
| --- | --- |
| bpftool prog list | List running eBPF programs |
| bpftool prog show <id> | Show details for a specific program |
| bpftool map list | List eBPF maps |
| bpftool map dump <id> | Dump map contents |
| bpftool net show | Show BPF programs per interface |

## 3 Essential Command Combinations

- `bpftool prog list` — Check running eBPF programs
- `bpftool map dump name my_map` — Check contents of a specific map
- `bpftool net show` — Check interfaces with attached XDP/TC programs
**💬 "Show me an example of using bpftool on a real server"**

Here is a step-by-step guide for common situations encountered on live production servers.

### Step 1 · Verify Installation

Check if it is installed.

```
bpftool version || sudo apt install -y linux-tools-$(uname -r)
```

### Step 2 · Program List

Check running eBPF programs.

```
sudo bpftool prog list
```

### Step 3 · Map Query

Check eBPF map contents.

```
sudo bpftool map list
```

## Actual Execution Output

This is the result of checking the attachment status of an XDP program using bpftool.

![bpftool command execution results](https://games.aidebatehub.com/assets/bpftool-demo.png)

Live Production Server

## How It's Used in Practice

### 1. Checking XDP Programs

**Situation** — Verify if the XDP filter is properly attached.

```
sudo bpftool net show
```

**Result** — prog_xdp_filter is visible on eth0.

**Key Point** — Directly verify the attachment status of the XDP program.

### 2. Querying Map Contents

**Situation** — Check a dynamically managed IP whitelist.

```
sudo bpftool map dump name blocklist
```

**Result** — The list of registered IPs is displayed.

**Key Point** — Verify data synchronization between the kernel and user space.

## Actual Execution Output

This is the result of querying map contents using bpftool map dump.

![bpftool command execution results 2](https://games.aidebatehub.com/assets/bpftool-demo2.png)

Live Production Server

## Important Notes

- bpftool requires root privileges. Map dumps may contain sensitive connection information.
- The output format may vary slightly depending on the kernel version. It is recommended to use the latest bpftool.
- Programs created with bpftrace are cleaned up on exit. To view them with bpftool, query while bpftrace is running.

---
Source (HTML): https://games.aidebatehub.com/programs/linux/troubleshooting/bpftool.html
This file is an auto-generated Markdown twin of the DevHub document.