microsoft/ebpf-for-windows

Health v2 · maintenance only

Flags: prerelease_only

Adoption not part of the score

3553 stars · 304 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

eBPF for Windows is an MIT-licensed implementation of the eBPF runtime that runs on top of the Windows kernel, letting developers reuse familiar Linux eBPF toolchains (clang, ELF bytecode, verifier APIs). It verifies and loads eBPF programs either as natively generated Windows driver modules or via a uBPF JIT service, enabling kernel programmability for networking, DoS protection, and observability.

Use cases

• run eBPF programs on Windows
• port Linux eBPF tools and programs to Windows
• packet filtering and network processing on Windows servers
• mitigate DDoS attacks at the kernel level on Windows
• observe and trace kernel and network events on Windows
• verify eBPF bytecode before loading it into the Windows kernel
• compile eBPF programs into signed Windows drivers

When to choose

• You need eBPF-based observability, tracing, or packet processing on Windows rather than Linux
• You want to reuse existing eBPF toolchains, bytecode, and APIs from the Linux ecosystem on Windows
• You need verified, safe kernel extensibility on Windows, especially with HVCI enforced (prefer the native driver mode)
• You are building Windows networking or security tooling that benefits from programmable kernel hooks

When to avoid

• You are targeting Linux or macOS, where the kernel's native eBPF stack is the right choice
• You require full feature parity with Linux eBPF, since this project is a work-in-progress with evolving hook and API coverage
• You need a guaranteed production-hardened eBPF stack today rather than an actively maturing one
• You only need user-space sandboxing or tracing without kernel integration

Facets

framework · maturity active

security networking tracing monitoring developer-tools operating-systems security networking developer-tools windows ebpf bpf kernel-programmability jit-compiler verifier windows-kernel observability packet-filtering ddos-protection xdp driver-development native-code-generation

Member repositories

For agents

markdown · JSON · MCP: product_card(name="microsoft/ebpf-for-windows")