bext-ebpf

eBPF acceleration for bext — XDP packet filtering, uprobe tracing, TCP intelligence, seccomp sandboxing.

Part of the bext stack.

[dependencies]
bext-ebpf = "0.2"

What this crate is

bext-ebpf adds kernel-level observability and acceleration to bext on Linux. It provides XDP hooks for packet-level filtering (pre-socket), uprobe tracing for production profiling without recompiles, TCP state intelligence, and seccomp sandboxing helpers.

Linux-only. On other platforms the crate compiles to a no-op shim so dependent crates stay portable.

Features

• XDP filtering — drop malicious packets in the kernel before they hit the socket layer.
• Uprobes — attach to userspace functions for production tracing.
• TCP intelligence — connection tracking, retry analysis.
• Seccomp helpers — structured seccomp-bpf policy generation.

bext-ebpf does not require CAP_BPF at runtime unless you enable XDP or uprobe hooks. The default observe mode is strictly read-only.

License

MIT.

See also

• github.com/bext-stack/bext — the bext meta repo
• Full ecosystem — all bext crates at a glance