bps(8)

✨ bps — bestie's guide to peeking at your BPF programs ✨

okay so like. this is bps(8), living in the System Manager's Manual, and it's literally ps but for BPF programs. that's the whole vibe. 🦋

---

💖 NAME 💖

bps — List all BPF programs. it's 'ps' for BPF programs. no cap, that's the official tagline and it ate. 👑

---

🌸 SYNOPSIS 🌸

bps [bpf-prog-id]

---

🎀 DESCRIPTION 🎀

so bps lists, like, every single BPF program that's loaded into the kernel. it's similar to the ps command bestie, except instead of processes it's BPF programs. same energy, different species. 💅

each loaded bpf program gets its own unique integer, and that's the bpf-prog-id, or just BID for short (iykyk). and here's the cute part: if you pass a bpf-prog-id, the maps that bpf-prog-id uses will also get listed. two for one. slay. ✨

---

🌈 EXAMPLES 🌈

list every BPF program that's loaded into the kernel:

bps

show the details <and> the maps of BID 6:

bps 6

---

👑 BPF PROGRAM FIELDS 👑

these are the columns you're gonna see, and yes we're going through all of them:

• BID — the BPF program ID. lowkey important detail: it ends with a - if it is not jitted. so if you see that little dash, that's what's up.
• TYPE — the type of a BPF program. e.g. kprobe, tracepoint, xdp...etc.
• UID — the user ID that loaded the BPF program. who did this. 🕵️
• #MAPS — total number of maps used by a BPF program.
• LoadTime — when was the BPF program loaded? like, timestamps bestie.
• NAME — the name of a BPF program. the user space library (like bcc) usually uses the C function name of the original BPF's source code as the program name. and it could be empty if the user space did not provide a name. not its fault. 🙈

---

🦋 BPF MAP FIELDS 🦋

and now the map side of things, all of it, no skipping:

• MID — BPF map ID.
• TYPE — the type of a BPF map. e.g. hash, array, stack trace...etc.
• FLAGS — the flags used to create the BP map.
• KeySz — the key size of a BPF map.
• ValueSz — the value size of a BPF map.
• MaxEnts — the maximum number of entries of a map.
• NAME — the name of a BPF map. the user space library (like bcc) usually uses the C variable name of the BPF map as its name. and it could be empty if the user space did not provide a name. again, not its fault. 🫶

---

💜 SOURCE 💜

this is from bcc. periodt.

https://github.com/iovisor/bcc

---

⭐ OS ⭐

Linux. obviously. 🐧

---

💀 STABILITY 💀

Unstable - in development. so like, it's giving "we're still cooking" energy. use it, love it, but know it's a work in progress bestie. 😭

---

🌸 AUTHOR 🌸

Martin Lau

---

okay and for the cute sign-off: this whole thing comes from the USER COMMANDS section, dated 2017-10-19, and it's filed under bps(8) — that's the manual page name, the one and only, the main character. 💖✨🎀