BCC

What BCC is

BCC is a toolkit for building programs that trace and manipulate the Linux kernel through eBPF. It is intended for self-hosted use, with performance analysis and network traffic control among its use cases. Kernel instrumentation is written in C, and Python and Lua front ends are available. Its workflow uses a shared library and an LLVM BPF backend for just-in-time compilation, with support for dynamically loading and unloading compiled programs. BCC can work with socket filters, tc classifiers and actions, and kprobes. The project also includes standalone utilities for observing a running system, with examples related to disk I/O, processes, network activity, and filesystems.

The installation guide generally calls for Linux kernel 4.1 or later and particular kernel configuration options. It provides package or installation guidance for Debian, Ubuntu, Fedora, Arch, Gentoo, openSUSE, RHEL, Amazon Linux, Alpine Linux, and WSL. Ubuntu Universe and iovisor BCC packages are described as outdated; the guide points to building from source for an up-to-date packaged version. BCC is free under Apache-2.0. Its README describes eBPF programs as sandboxed bytecode run by the kernel and says loaded BPF programs cannot crash or run forever. Project discussion and help are available through the GitHub issue tracker, IOVisor mailing list, and #iovisor IRC channel.

Who it suits

BCC suits Linux users who need to create kernel tracing or manipulation programs for performance analysis or network traffic control. It is also a fit for people seeking command-line tools to inspect disk, process, network, or filesystem activity on a running system.

Limits

BCC generally requires Linux kernel 4.1 or newer and specified kernel configuration options. The guide says Ubuntu Universe and iovisor BCC packages are outdated and recommends building from source for an up-to-date packaged version.

Getting started

1. Open the BCC GitHub project page.
2. Check that the system meets the Linux kernel and configuration requirements.
3. Follow the installation guidance for the relevant distribution or WSL.
4. For an up-to-date packaged version, build from source as the guide recommends.
5. If loading a BPF program returns “Operation not permitted,” consult the FAQ guidance about sudo.

Verdict

Choose BCC if you need a free, self-hosted toolkit for eBPF kernel tracing or manipulation on Linux. Its included system tracing tools and several supported kernel hooks make it relevant to performance and network work. Check the kernel version and configuration requirements before choosing it.