bpftool-feature(8)

✨ NAME ✨

bpftool-feature — okay so this is the member of the bpftool fam whose whole job is inspecting eBPF-related parameters for the Linux kernel or for a net device. That's it. That's the girl. 🎀

---

🦋 SYNOPSIS 🦋

bpftool [OPTIONS] feature COMMAND

OPTIONS := { { -j | --json } [{ -p | --pretty }] | { -d | --debug } }

COMMANDS := { probe | help }

---

👑 FEATURE COMMANDS 👑

bpftool feature probe [COMPONENT] [full] [unprivileged] [macros [prefix PREFIX]]
bpftool feature list_builtins GROUP
bpftool feature help

COMPONENT := { kernel | dev NAME }
GROUP := { prog_types | map_types | attach_types | link_types | helpers }

---

💅 DESCRIPTION 💅

bpftool feature probe [kernel] [full] [macros [prefix PREFIX]]

Probes the running kernel and dumps a whole bunch of eBPF-related parameters, bestie. Like: is the bpf() system call even there, what's the JIT status, which eBPF program types are available, which eBPF helper functions are available, and more. ✨

So by default, bpftool does not run probes for the bpf_probe_write_user() and bpf_trace_printk() helpers, because those two literally print warnings into the kernel logs (messy behavior, honestly 🙈). Wanna run all the probes including those? Drop the full keyword in there. Periodt.

If you pass the macros keyword (but not the -j option), a subset of the output gets dumped as a list of #define macros that are ready to be included in a C header file, for example. And if you additionally use prefix to define a PREFIX, then that string you gave gets used as a prefix on the names of the macros — which slays for avoiding conflicts on macro names when you're including the output of this command as a header file. 💖

The kernel keyword can be omitted. If no probe target is specified, probing the kernel is the default behavior. Easy.

When the unprivileged keyword is used, bpftool will dump only the features available to a user who does not have the CAP_SYS_ADMIN capability set. The features available in that case usually represent a small subset of the parameters supported by the system. And this is the important part: unprivileged users MUST use the unprivileged keyword — this is to avoid misdetection if bpftool is inadvertently run as non-root, for example. 🫶

Heads up bestie: this keyword is unavailable if bpftool was compiled without libcap. No cap, literally.

bpftool feature probe dev NAME [full] [macros [prefix PREFIX]]

Probes a network device for supported eBPF features and dumps the results to the console. 📡

The keywords full, macros and prefix do the exact same thing here as they do when you're probing the kernel. Same energy, different target.

bpftool feature list_builtins GROUP

Lists the items known to bpftool. These can be BPF program types (prog_types), BPF map types (map_types), attach types (attach_types), link types (link_types), or BPF helper functions (helpers).

The way that this one does not probe the system — it just simply lists the elements that bpftool knows from compilation time, as provided from libbpf (for all object types) or from the BPF UAPI header (that's the list of helpers). So if you wanna iterate over BPF types or helpers in a script, this is your girl. 🔥

bpftool feature help

Prints a short help message. That's it, that's the whole thing. 🌸

---

🌈 OPTIONS 🌈

• -h, --help — Prints a short help message (similar to bpftool help). 💖
• -V, --version — Prints bpftool's version number (similar to bpftool version), the number of the libbpf version in use, and the optional features that were included when bpftool was compiled. Those optional features include linking against LLVM or libbfd to provide the disassembler for JIT-ted programs (bpftool prog dump jited), and usage of BPF skeletons (some features like bpftool prog profile, or showing pids associated to BPF objects, may rely on it). ⭐
• -j, --json — Generates JSON output. For commands that cannot produce JSON, this option has no effect. No thoughts, no JSON, no problem. 🙈
• -p, --pretty — Generates human-readable JSON output. Implies -j. Icons only behavior. 💅
• -d, --debug — Prints all logs available, even debug-level information. This includes logs from libbpf as well as from the verifier, when attempting to load programs. Maximum yapping, but make it useful. 🔍

---

🦋 SEE ALSO 🦋

bpf(2), bpf-helpers(7), bpftool(8), bpftool-btf(8), bpftool-cgroup(8), bpftool-gen(8), bpftool-iter(8), bpftool-link(8), bpftool-map(8), bpftool-net(8), bpftool-perf(8), bpftool-prog(8), bpftool-struct_ops(8), bpftool-token(8)

---

okay and that's the whole page bestie!! 💖 This one lives in the System Manager's Manual, and yes, the page itself is literally called bpftool-feature(8) — iconic name, iconic behavior, go probe something. 🧚✨