BCC
What it is
BCC is a free toolkit for building kernel tracing and manipulation programs with eBPF, intended for Linux and self-hosted use. Its stated applications include performance analysis and network traffic control. Developers write kernel instrumentation in C and can use Python or Lua front ends. The workflow includes a shared library, an LLVM BPF backend for just-in-time compilation, and dynamic loading and unloading of compiled programs. Supported hooks include socket filters, tc classifiers and actions, and kprobes. BCC also includes standalone tools for tracing a running system, with examples involving disk I/O, processes, networking and filesystems. Installation generally requires Linux kernel 4.1 or newer and specified kernel configuration options. Installation guidance covers Debian, Ubuntu, Fedora, Arch, Gentoo, openSUSE, RHEL, Amazon Linux, Alpine Linux and WSL. The guide says Ubuntu Universe and iovisor BCC packages are outdated and points to building from source for an up-to-date packaged version. The project is Apache-2.0 licensed. Its README describes eBPF programs as sandboxed kernel-executed bytecode and says loaded programs cannot crash or run forever.
For and against
For
- Free and Apache-2.0 licensed
- C instrumentation with Python and Lua front ends
- Includes tools for disk, process, network and filesystem tracing
- Supports several kernel hooks, including kprobes
- Installation guidance covers multiple Linux distributions and WSL
Against
- Generally requires Linux kernel 4.1 or newer
- Specified kernel configuration options are required
- Ubuntu Universe and iovisor BCC packages are outdated
- Some BPF load failures may require sudo
The verdict
BCC provides a broad set of eBPF tracing tools and workflows for Linux environments. Check kernel configuration and package status before choosing an installation route.
Who it suits
BCC suits Linux developers and operators who need eBPF-based kernel tracing, performance analysis or network traffic control. It assumes familiarity with Linux setup and kernel requirements.
Plans and prices
BCC
Apache-2.0 licensed · Linux kernel 4.1 or newer required
Read 4 Oct 2026 · github.com
On the record
- Distribution packages
- The installation guide lists packages or installation instructions for Debian, Ubuntu, Fedora, Arch, Gentoo, openSUSE, RHEL, Amazon Linux, Alpine, and WSL.github.com · read 4 Oct 2026
- Included tools
- The project includes self-contained tools for tracing a running system, including examples for disk I/O, processes, networking, and filesystems.github.com · read 4 Oct 2026
- Kernel hooks
- BCC supports socket filters, tc classifiers, tc actions, and kprobes.github.com · read 4 Oct 2026
- Languages
- BCC provides kernel instrumentation in C, with front ends in Python and Lua.github.com · read 4 Oct 2026
- License
- The repository identifies Apache-2.0 as its license.github.com · read 4 Oct 2026
- Linux requirement
- The installation guide says Linux kernel 4.1 or newer is generally required, along with specified kernel configuration options.github.com · read 4 Oct 2026
- Package limitation
- The guide says Ubuntu Universe and iovisor BCC packages are outdated and that building from source is the way to get an up-to-date packaged version.github.com · read 4 Oct 2026
- Permissions
- The FAQ says a BPF program load failure with “Operation not permitted” may require running with sudo.github.com · read 4 Oct 2026
- Purpose
- BCC is a toolkit for creating efficient kernel tracing and manipulation programs using eBPF.github.com · read 4 Oct 2026
- Security model
- The README describes eBPF programs as sandboxed bytecode executed by the kernel and says BPF programs loaded into the kernel cannot crash or run forever.github.com · read 4 Oct 2026
- Support
- The project points users to its GitHub issue tracker, the IOVisor mailing list, and the #iovisor IRC channel for project discussion and help.github.com · read 4 Oct 2026
- Use cases
- BCC is suited to performance analysis and network traffic control.github.com · read 4 Oct 2026
- Workflow
- Its features include a shared library workflow, an LLVM BPF backend for JIT, and dynamic loading and unloading of JITed programs.github.com · read 4 Oct 2026
