Ebpf

This skill walks you through writing, loading, and debugging eBPF programs for kernel tracing and packet processing. It covers the full stack: bpftrace one-liners for quick tracing, libbpf skeletons for production programs, XDP for network filtering, and CO-RE for portability across kernel versions. The verifier error triage table alone will save you hours of head-scratching. If you're instrumenting syscalls, debugging network performance, or just tired of guessing why the verifier rejected your pointer arithmetic, this is the reference you want. Assumes you're comfortable with C and Linux internals.

skills.sh installs: 672
GitHub stars: 279
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add mohitmishra786/low-level-dev-skills --skill ebpf --agent claude-code

Installs into .claude/skills of the current project.

Files

eBPF

Purpose

Guide agents through writing, loading, and debugging eBPF programs using libbpf, bpftrace, and bpftool. Covers map types, program types, verifier errors, XDP networking, and CO-RE portability.

Triggers

"How do I write an eBPF program to trace system calls?"
"My eBPF program fails with a verifier error"
"How do I use bpftrace to trace kernel events?"
"How do I share data between kernel eBPF and userspace?"
"How do I write an XDP program for packet filtering?"
"How do I make my eBPF program portable across kernel versions (CO-RE)?"

Workflow

1. Choose the right tool

Goal?
├── One-liner kernel tracing / scripting → bpftrace
├── Production eBPF program with userspace → libbpf (C) or aya (Rust)
├── Inspect loaded programs and maps → bpftool
└── High-performance packet processing → XDP + libbpf

2. bpftrace — quick kernel tracing

# Trace all execve calls with comm and args
bpftrace -e 'tracepoint:syscalls:sys_enter_execve { printf("%s %s\n", comm, str(args->filename)); }'

# Count syscalls by process
bpftrace -e 'tracepoint:raw_syscalls:sys_enter { @[comm] = count(); }'

SKILL.md on GitHub