bpf-ninja

[!NOTE] This project was renamed from xdp-ninja (July 2026): the tool has outgrown XDP — it also observes tc-bpf programs, and more BPF hook points are planned. GitHub redirects the old repository URL, but the Go module path changed to github.com/takehaya/bpf-ninja, so go install / imports need the new path. Environment variables are now BPF_NINJA_* (the old XDP_NINJA_* names are no longer read).

bpf-ninja captures packets at BPF hook points — XDP, tc-bpf, cgroup-skb, and netfilter, with more planned. tcpdump runs below XDP and can’t show what XDP or tc-bpf did to the packet, and cBPF filters can’t walk into VXLAN / GTP / MPLS / SRv6 inner headers. Attach via fentry/fexit to a running XDP without modifying it, or --mode xdp for standalone capture on a netdev. Filters use the built-in DSL by default — chains like eth/ipv4/udp/vxlan/eth/ipv4/tcp. Plain tcpdump syntax via cbpfc is still accepted via --cbpf, kept for backwards compatibility and planned to retire once the DSL surface stabilises. Output is pcap (pcapng) to stdout.🥷

Install

# One-liner (downloads pre-built binary from GitHub…

score = signal / reach signal = 0.25·commit_velocity // commits in last 90 days (cap 30) + 0.20·contributor_work // unique authors × velocity (cap 100) + 0.20·issue_resolution // closed ÷ total issues + 0.20·fork_ratio // forks ÷ stars (proxy for real usage) + 0.10·release_cadence // releases in 90 days (cap 3) + age_bonus // +0 to +0.30 after 6 months + homepage_bonus // +0.05 if homepage is set reach = log₁₀(stars + watchers + 10)█

health = 0.35·recency // days since last commit (90d decay) + 0.25·cadence // commit rhythm consistency + 0.20·issue_health // closed ÷ total issues + 0.20·pr_health // merged ÷ total PRs█

Healthy 80 – 100 active, responsive, regular releases Stable 60 – 79 maintained, steady, no alarms Quiet 40 – 59 slowing down — watch this one At Risk 0 – 39 going dark · candidate for rescue█

solo_builder one person holds > 80% of commits (last 180d) needs_contributors has open "help wanted" or "good first issue" labels hidden_gem < 100 stars · active in last 3 months · documented legacy_hero repo > 5 years old · committed this year fork_magnet forks/stars > 0.5 · used as template or dependency release_machine 5+ releases in the last 90 days under_pressure > 10 open issues · ≤ 2 contributors · health ≥ 60 community_watch watchers > stars · devs tracking before the public community_hub GitHub Discussions enabled · > 20 discussions funded maintainer has active funding channel█