close

A top for eBPF programs.

Real-time average runtime per call, events/s, and CPU utilization for every loaded eBPF program.

root@kernel:~$ sudo bpftop
● demo
bpftop demo

Install

Pre-built x86_64 or aarch64 binary, or your distro's package.
Dynamically links to libz and libelf.

$sudo apt install bpftop
Available on Debian, Ubuntu, Kali, Parrot, Raspbian, and Devuan.

Run

Stats collection is off by default in the kernel. bpftop flips it on while the session is open and flips it off on exit — so you pay the overhead only while you're looking.

root@kernel:~$ man bpftop
● help
# 1. Launch it. Needs root (CAP_BPF + CAP_SYS_ADMIN). $ sudo bpftop # 2. Slow the refresh down if you want (default 1s, range 1–3600): $ sudo bpftop -d 5 # 3. Once it's running, your hands never leave the home row:
── navigation ──
/ kjmove up / down
drill into program → graphs
qquit (and disable stats)
── actions ──
ffilter by name, type, or comm
ssort column, then to toggle ↑↓
escleave filter / sort / graph mode
Tweaks