logo

microsoft/ebpf-for-windows

eBPF implementation that runs on top of Windows

View on GitHub ↗Jump to charts ↓Open shareable report →

Data as of . Signed-in members get hourly updates — create a free account.

Summary Information

Updated 28 minutes ago
Type:Library / SDKCategory(s):GPU, Accelerators & HPCObservability & MonitoringSystems, Hardware & HPC
Added to GitGenius on September 19th, 2026
Created on April 8th, 2021
Open Issues & Pull Requests: 331 (+0)
GitHub issues: Enabled
Number of forks: 309
Total Stargazers: 3,570 (+0)
Total Subscribers: 53 (+0)

Repository Insights (GitGenius)

Median issue/PR response: 3.0 days
Mean response time: 18.8 days
90th percentile: 6.9 days
Tracked items: 851

Most active contributors

Sign in to see contributor activity.
Sign in

Related repositories by overlapping contributors

Maintainer activity

15 people did triage or write work on this repository in the last 12 months.

Counts unlabeled, assigned, unassigned, milestoned, demilestoned, locked, unlocked over the last 12 months. These are issue and pull request events that require triage or write permission. Commits and code review are not counted. labeled and renamed are excluded because GitHub issue forms record the issue author as the actor. Figures from October 11, 2026. This count is not comparable across projects: each project's automation decides which of these events a person emits.

How this project is maintained

Practically every issue opened in the past year has drawn a reply. 55% of open issues come from outside the core team, a mix of external reports and the maintainers' own roadmap. Almost all tracked open issues have seen activity in the last three months. 83% of issues opened in the past year have been closed, leaving a working backlog. Three people close 78% of everything that gets resolved.

Charts & Analytics

Fetching additional details & charts...

Issue Activity (beta)

Open issues: 167
New in 7 days: 3
Closed in 7 days: 5
Avg open age: 590 days
Stale 30+ days: 53
Stale 90+ days: 49

Recent activity

Opened in 7 days: 2
Closed in 7 days: 4
Comments in 7 days: 0
Events in 7 days: 0

Top labels

  • triaged (604)
  • bug (405)
  • ci/cd (294)
  • P2 (267)
  • enhancement (180)
  • P1 (91)
  • tests (86)
  • P3 (73)

Most active issues this week

Sign in to see which issues are moving.
Sign in
Explore full issue details

Detailed Description

eBPF for Windows is an eBPF implementation that runs on top of Windows, enabling developers to use existing eBPF toolchains and APIs familiar from the Linux ecosystem on Windows systems.

The project addresses the challenge of bringing eBPF's programmability and kernel extensibility to Windows, where eBPF is not natively supported. It works by taking existing eBPF projects as submodules and adding an intermediate layer that allows them to function on Windows. Developers can use standard eBPF toolchains like clang to generate eBPF bytecode in ELF format, which the project then processes through one of three approaches: native code generation via the bpf2c tool and PREVAIL verifier, JIT compilation through a user-mode service, or interpretation in kernel mode. The native approach is preferred and most secure, converting eBPF bytecode to equivalent C code that builds into Windows driver modules. Programs can be loaded and managed through libbpf APIs, bptool, or Netsh, and attach to various kernel hooks while calling helper APIs that wrap Windows kernel functionality.

Adoption suits teams needing kernel-level observability, DoS protection, or other extensibility on Windows systems where eBPF knowledge and tooling already exist. The native code generation path is recommended for production deployments due to its security properties with hypervisor-enforced code integrity. The project exposes libbpf APIs, making it familiar to developers experienced with eBPF on Linux, though Windows-specific hooks and helpers determine what use cases are practical on any given Windows version.

Development activity shows ongoing expansion of capabilities, with new hooks and helper APIs being added incrementally. The project maintains documentation including tutorials for eBPF basics and debugging verification failures, supporting developers new to the technology. The codebase is written primarily in C and integrates established external verifiers and JIT compilers rather than building these components from scratch.