BPF
also: eBPF, extended BPF
Berkeley Packet Filter (BPF) is a kernel technology that allows safe, in-kernel execution of sandboxed programs for monitoring, filtering, and analyzing system events without requiring kernel module compilation.
BPF enables developers to write small programs that run directly in the Linux kernel with minimal overhead. These programs can inspect network packets, system calls, and other kernel events in real-time, making decisions about filtering or logging without context-switching to user space.
Originally designed for packet filtering in tcpdump (hence "Berkeley Packet Filter"), BPF has evolved into eBPF (extended BPF), a general-purpose in-kernel virtual machine. Modern eBPF programs can monitor system calls, trace function execution, and implement network policies.
Example use cases include tcpdump filtering packets, perf profiling CPU cycles, and container runtime security tools like Falco. Programs are written in C, compiled to BPF bytecode, and verified by the kernel before loading to ensure safety.
BPF eliminates the need to write kernel modules for many monitoring tasks, making it safer, easier to deploy, and more portable across kernel versions.