Skip to content
Utility based on bpftool to manage eBPF maps
Branch: master
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
src add support for python < 3.7 Jul 14, 2019
LICENSE add License Jun 27, 2019
bpfctrl bpfctrl: no sys.exit in a module Jun 30, 2019 bpfctrl: types are check in module Jun 28, 2019


A bpftool wrapper to handle eBPF maps.

Setup instruction


You need to install bpftool.

$ git clone
$ cd linux/tools/bpf/bpftool/
$ make && sudo make install
$ sudo make doc-install

bpfctrl installation

If pip3 (pip for Python3) is not installed on the system :

$ sudo apt-get install python3-pip

Then, in the same directory as the file of bpfctrl:

$ pip3 install .

Examples of bpfctrl use

It can handle eBPF maps where keys are IPV4 addresses, and also maps that contain just one integer and key is 0. The type of map has to be precised in the command line with ipv4 for the first and uniq for the second.

Map Modification


The following command line adds the IPV4 address with the value 1 in the pinned map /sys/fs/bpf/suricata-wlp4s0-ipv4_drop.

$ sudo bpfctrl -m /sys/fs/bpf/suricata-wlp4s0-ipv4_drop ipv4 --add

This address can also be removed.

$ sudo bpfctrl -m /sys/fs/bpf/suricata-wlp4s0-ipv4_drop ipv4 --remove

It is possible to add or to remove several addresses at the same time.


The following command line sets the value of the integer contained in the pinned map /sys/fs/bpf/map at 1.

$ sudo bpfctrl -m /sys/fs/bpf/map uniq --set 1

Map Access

With the flag --json, the output of the program and the file written are in JSON format.


The dump of the map is done with the flag --dump

$ sudo bpfctrl -m /sys/fs/bpf/suricata-wlp4s0-ipv4_drop ipv4 --dump    28    8

$ sudo bpfctrl -m /sys/fs/bpf/map uniq --dump

The result of the dump can be store in a file if its paths is precised. If the file already exists, its content will be overwritten.

$ sudo bpfctrl  -m /sys/fs/bpf/suricata-wlp4s0-ipv4_drop ipv4 --dump ~/map.txt


The value associated at one IP is available with --get IP action.

$ sudo bpfctrl -m /sys/fs/bpf/suricata-wlp4s0-ipv4_drop ipv4 --get    4

Some eBPF maps store for each IP address, a value per CPU. With the flag --cpu, dump and get commands conserve it on the final output. Without it, the value display is the sum of the value of each CPU.

$ sudo bpfctrl -m /sys/fs/bpf/suricata-wlp4s0-ipv4_drop ipv4 --get --cpu    2    2    2    2

$ sudo bpfctrl -m /sys/fs/bpf/suricata-wlp4s0-ipv4_drop ipv4 --get    8

Combined Commands

The commands can be combined.


First, the program adds the elements and then removes. The dump of the map and the get are done at the end.

$ sudo bpfctrl -m /sys/fs/bpf/suricata-wlp4s0-ipv4_drop ipv4 --add --remove --dump --json
    "": 9


$ sudo bpfctrl -m /sys/fs/bpf/map uniq --set 3  --dump
You can’t perform that action at this time.