Networking and Systems Projects
C, C++, eBPF, and Python projects in networking, packet analysis, kernel tracing, and security. Sorted by contributor friendliness.
eBPF and Kernel Tracing
bpftrace - High-Level Tracing Language
| Repo | bpftrace/bpftrace |
| Stars | 9.9k |
| Language | C++ |
| Good First Issues | 22 open |
| What it does | High-level tracing language for Linux eBPF, inspired by awk and DTrace |
| Why contribute | Best entry point for eBPF. 22 good-first-issues. Excellent docs. |
| Entry points | New tracing probes, language features, bug fixes, docs |
| Requires | Linux, C++ basics, interest in kernel internals |
BCC - BPF Compiler Collection
| Repo | iovisor/bcc |
| Stars | 22.2k |
| Language | C + Python |
| Good First Issues | 1 open |
| What it does | Toolkit for creating eBPF-based kernel tracing and manipulation programs |
| Why contribute | Foundational eBPF project. Write kernel probes in C, frontends in Python. |
| Entry points | New tools, Python wrappers, documentation |
| Requires | Linux 4.1+, C basics, Python |
Cilium - eBPF Networking for Kubernetes
| Repo | cilium/cilium |
| Stars | 23.6k |
| Language | Go + C (eBPF) |
| Good First Issues | 0 |
| CNCF | Graduated |
| What it does | eBPF-powered networking, security, and observability for Kubernetes |
| Why contribute | Industry-leading CNI. Combines Go (control plane) with C (datapath eBPF). |
| Challenge | Large codebase, no labeled beginner issues. Requires deep K8s networking knowledge. |
Falco - Runtime Security
| Repo | falcosecurity/falco |
| Stars | 8.6k |
| Language | C++ |
| Good First Issues | 0 |
| CNCF | Graduated |
| What it does | Detects anomalous activity in containers using eBPF/kernel syscall monitoring |
| Why contribute | Security-focused. The Go SDK and Falco rules are easier entry points than the C++ core. |
| Entry points | Detection rules (YAML), Go SDK plugins, docs |
libbpf - eBPF Library
| Repo | libbpf/libbpf |
| Stars | 2.6k |
| Language | C |
| What it does | Core library for loading and interacting with eBPF programs (used by bpftrace, Cilium, etc.) |
| Why contribute | Low-level kernel interface. Deep learning opportunity. Small focused codebase. |
| Challenge | Requires strong C and Linux kernel understanding. |
Packet Capture and Analysis
nmap - Network Scanner
| Repo | nmap/nmap |
| Stars | 12.3k |
| Language | C/C++ + Lua |
| Good First Issues | 5 open |
| What it does | Network discovery and security auditing tool |
| Why contribute | Legendary tool. NSE scripts (Lua) are an easy entry point. |
| Entry points | NSE scripts, bug fixes, documentation |
Netdata - Real-Time Monitoring
| Repo | netdata/netdata |
| Stars | 77.6k |
| Language | C |
| Good First Issues | 0 |
| What it does | Real-time performance and health monitoring for systems and applications |
| Why contribute | Massive project, C-heavy. Collectors and plugins are easier entry points. |
Suricata - IDS/IPS
| Repo | OISF/suricata |
| Stars | 6k |
| Language | C |
| What it does | High-performance IDS, IPS, and network security monitoring engine |
| Why contribute | Deep packet inspection, protocol detection. Core network security tool. |
PcapPlusPlus - Packet Parsing Library
| Repo | seladb/PcapPlusPlus |
| Stars | 3.1k |
| Language | C++ |
| What it does | Multi-platform C++ library for capturing, parsing, and crafting network packets |
| Why contribute | Clean C++ codebase, good docs. Supports AF_XDP/eBPF sockets. |
| Entry points | Protocol parsers, platform support, docs |
tcpdump and libpcap
| Repo | the-tcpdump-group/tcpdump / libpcap |
| Stars | 3.1k / 3k |
| Language | C |
| What it does | The standard packet capture tools for Unix systems |
| Why contribute | Foundational networking tools. Deep protocol knowledge. |
Scapy - Packet Manipulation (Python)
| Repo | secdev/scapy |
| Stars | 12k |
| Language | Python |
| What it does | Interactive packet manipulation library and tool |
| Why contribute | Python-based, great for learning protocols. Can craft, send, sniff, decode packets. |
mitmproxy - HTTPS Proxy (Python)
| Repo | mitmproxy/mitmproxy |
| Stars | 42.1k |
| Language | Python |
| What it does | Interactive HTTPS proxy for debugging, testing, and penetration testing |
| Why contribute | TLS interception, HTTP/2, WebSocket support. Excellent learning tool. |
Learning Resources
| Resource | URL |
|---|---|
| Learning eBPF (Liz Rice) | github.com/lizrice/learning-ebpf |
| Awesome eBPF | github.com/zoidyzoidzoid/awesome-ebpf |
| eBPF.io | ebpf.io |
| eBPF Applications | ebpf.io/applications |