BPFTOOL(8)

💖 BPFTOOL — bestie's guide to poking at eBPF ✨

okay so this is the manual page for bpftool, which lives in section 8 of the System Manager's Manual. she's the tool for inspection and simple manipulation of eBPF programs and maps, and honestly? she ate. let's get into it 🫶

---

🌸 SYNOPSIS 🌸

here's the whole vibe, verbatim, no notes:

bpftool [OPTIONS] OBJECT { COMMAND | help }

bpftool batch file FILE

bpftool version

OBJECT := { map | prog | link | cgroup | perf | net | feature | btf |
gen | struct_ops | iter }

OPTIONS := { { -V | --version } | { -j | --json } [{ -p | --pretty }] |
{ -d | --debug } }

MAP-COMMANDS := { show | list | create | dump | update | lookup |
getnext | delete | pin | event_pipe | help }

PROG-COMMANDS := { show | list | dump jited | dump xlated | pin | load |
attach | detach | help }

LINK-COMMANDS := { show | list | pin | detach | help }

CGROUP-COMMANDS := { show | list | attach | detach | help }

PERF-COMMANDS := { show | list | help }

NET-COMMANDS := { show | list | help }

FEATURE-COMMANDS := { probe | help }

BTF-COMMANDS := { show | list | dump | help }

GEN-COMMANDS := { object | skeleton | min_core_btf | help }

STRUCT-OPS-COMMANDS := { show | list | dump | register | unregister |
help }

ITER-COMMANDS := { pin | help }

like. LOOK at all those little objects and commands. it's giving menu at a restaurant where every dish is a kernel subsystem 💅

---

✨ DESCRIPTION ✨

bpftool lets you inspect and simply modify BPF objects hanging out on your system. lowkey iconic behaviour.

⚠️ ok bestie, gentle heads up: the format of the output of all the tools is not guaranteed to be stable and you should not depend upon it. fr fr. don't be out here parsing it like it's a stable API, because it is not. 🙈

---

🎀 OPTIONS 🎀

• -h, --help — prints a short help message, basically the same energy as bpftool help.
• -V, --version — prints bpftool's version number (kinda like bpftool version does), plus the number of the libbpf version in use, plus any optional features that got included when bpftool was compiled. those optional features include linking against LLVM or libbfd so you get the disassembler for JIT-ted programs (bpftool prog dump jited), and usage of BPF skeletons — and heads up, some features like bpftool prog profile or showing pids associated to BPF objects may rely on it. 🦋
• -j, --json — generate JSON output ✨. for commands that cannot produce JSON, this option has no effect (nothing happens, she's just sitting there, respectfully).
• -p, --pretty — generate human-readable JSON output. implies -j. so you get pretty AND json, we love a combo 🎀
• -d, --debug — print all logs available, even debug-level information. this includes logs from libbpf as well as from the verifier, when attempting to load programs. it's a lot of tea and she spills all of it 👑
• -m, --mapcompat — allow loading maps with unknown map definitions. living dangerously, we respect it.
• -n, --nomount — do not automatically attempt to mount any virtual file system (such as tracefs or BPF virtual file system) when necessary. hands off the filesystems, she said 💅

---

🌈 SEE ALSO 🌈

go read these too, they're all part of the same friend group:

bpf(2), bpf-helpers(7), bpftool-btf(8), bpftool-cgroup(8), bpftool-feature(8), bpftool-gen(8), bpftool-iter(8), bpftool-link(8), bpftool-map(8), bpftool-net(8), bpftool-perf(8), bpftool-prog(8), bpftool-struct_ops(8), bpftool-token(8)

---

ok that's the whole page, you're officially educated ✨ this was BPFTOOL(8), straight out of the System Manager's Manual — section 8, as the footer will tell you. mwah, go inspect some maps, bestie 💖 🦋 🎀 periodt.