GitHub - lbrndnr/beeper: Application-Layer Parsing in eBPF · GitHub
/" data-turbo-transient="true" />
Skip to content
Search/
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
lbrndnr
beeper
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
main
BranchesTags
Go to file
CodeOpen more actions menu
Latest commit
History<br>213 Commits<br>213 Commits
Folders and files<br>NameNameLast commit message<br>Last commit date<br>.cargo
.cargo
.github
.github
beeper
beeper
example
example
utils
utils
.gitignore
.gitignore
Cargo.lock
Cargo.lock
Cargo.toml
Cargo.toml
LICENSE
LICENSE
README.md
README.md
View all files
Repository files navigation
Beeper: Application-Layer Parsing in eBPF
Beeper (BEEline's ParsER) is an application-layer parser for eBPF. It allows you to process L7 protocols directly in the kernel, which can accelerate user space applications significantly. It achieves this by constructing an Aho-Corasick-like DFA in user space, reducing the parsing complexity to an eBPF-compatible level. With Beeper, you can for example monitor application-layer traffic, redirect it based on its payload, or respond to it, directly from the kernel. For more information, please have a look at the full paper.
Protocol<br>Status<br>Minimal Kernel Version
HTTP/1.1<br>6.8
HTTP/2<br>7.0
gRPC<br>WIP
Build
To build and test Beeper, you need to install the following packages:
sudo apt install clang-18 llvm-18 libelf-dev zlib1g-dev linux-headers-`uname -r` linux-tools-`uname -r`
You should now be able to compile and test Beeper as follows:
RUST_LOG=trace cargo test
Running the Example
Once you can build Beeper, you can also run the example. It is a simple HTTP server, with Beeper attached to it. It will serve some static files directly from the kernel. To run it, first start the server:
cargo run --bin example
Then, in another terminal, make a request to the server:
curl -vv http://127.0.0.1:8080/index.html
In the logs of the server, you should find a line that indicates that the request was served directly from the kernel:
Served request
To benchmark the server, run the following:
# server accelerated with beeper<br>RUST_LOG= cargo run -r --bin example<br># baseline: server without the fastpath<br>RUST_LOG= cargo run -r --bin example -- --no-fastpath
In a new window, you can now run the load test:
cargo install oha
# to test http1 performance<br>oha -c 100 -q 1000 -z 30s --latency-correction --urls-from-file example/load.txt<br># to test http2 performance<br>oha -c 100 -q 1000 -z 30s --http2 --latency-correction --urls-from-file example/load.txt
Citation
If you use this library to conduct your own research, please cite the full paper as follows:
@misc{brandner2026enforcingapplicationlayerpoliciesebpf,<br>title={Enforcing Application-Layer Policies in eBPF},<br>author={Laurin Brandner and Ayush Mishra and Sebastiano Miano and Aurojit Panda and Gianni Antichi and Laurent Vanbever},<br>year={2026},<br>eprint={2605.31084},<br>archivePrefix={arXiv},<br>primaryClass={cs.NI},<br>url={https://arxiv.org/abs/2605.31084},
About<br>Application-Layer Parsing in eBPF<br>arxiv.org/abs/2605.31084<br>Topics<br>application-layerebpfhttp<br>Resources<br>Readme<br>GPL-3.0 license<br>Activity<br>Stars<br>1 star<br>Watchers<br>1 watching<br>Forks<br>0 forks<br>Report repository
Releases
Contributors
Languages
You can’t perform that action at this time.