# cloudflare/bpftools

BPF Tools - packet analyst toolkit

Repository: https://github.com/cloudflare/bpftools
Canonical: https://ross.abutalabs.com/products/bpftools
Language: Python
License: BSD-3-Clause
License Family: permissive
Last push: 2026-04-24T00:36:22+00:00

## Health v2 (maintenance only)
Score: 67/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 78, release rhythm 35, longevity 100
- inputs: {"age_days": 4501, "days_push": 132, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1230, forks 141 (observed 2026-08-28T04:04:04.145640+00:00)

## What it is
A toolkit of Python scripts and Linux binaries for analyzing pcap traffic dumps and generating BPF bytecode. Its core purpose is crafting BPF and iptables rules that match and drop malicious traffic, such as packets targeting specific DNS domains.

## Use cases
- generate BPF bytecode to match malicious traffic
- create iptables rules to drop packets to a domain
- analyze pcap traffic dumps
- convert between pcap files and hex
- parse DNS packets from captures
- write BPF filters matching DNS queries or domain suffixes

## When to choose
- you need to drop DDoS or malicious traffic with iptables BPF rules
- you want to generate BPF bytecode matching DNS domain patterns
- you analyze packet captures on Linux

## When to avoid
- you need a general-purpose packet capture tool like tcpdump
- you work on non-Linux platforms
- you need eBPF program development rather than classic BPF filtering

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, networking, parser, developer-tools
- domain: networking, security, developer-tools
- platform: python, cli
- tags: bpf, pcap, iptables, packet-analysis, ddos-mitigation, dns-filtering, command-line, linux

## Member repositories
- cloudflare/bpftools (main) score 67

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:04.145640+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:13:54.308471+00:00, confidence not recorded.
  - readme: https://github.com/cloudflare/bpftools (fetched 2026-08-28T04:04:04.145640+00:00, sha c51f0532b9f1)
- Data as of 2026-08-30T08:39:29.467469+00:00.