bpf

BPF, short for Berkeley Packet Filter, is a compact, domain-specific virtual machine and instruction set used to filter and process data streams inside the kernel and in user space. It originated in BSD systems to efficiently capture network packets by applying a filter that determines which packets are delivered to user-space programs. The filter is compiled into bytecode and executed by the BPF virtual machine.

Historically, BPF was introduced in the early 1990s by researchers at UC Berkeley. A user-space program compiles filtering logic into BPF bytecode, attaches it to a data stream (such as a network socket), and the kernel runs the filter as packets arrive, reducing unnecessary data copies and improving capture performance.

In Linux, BPF evolved into extended BPF (eBPF), a general-purpose in-kernel virtual machine that supports a wider set of program types and data structures. eBPF programs run in a verified sandbox, are often just-in-time compiled to native code, and can access persistent state through maps. They can be attached to networking hooks, tracing events, perf events, and other in-kernel points, enabling dynamic, low-overhead observability, networking, and policy enforcement.

Common use cases include packet filtering and capture, high-performance in-kernel networking via XDP (Express Data Path), dynamic tracing and profiling with tools such as bpftrace, and security or policy enforcement in modern systems (for example, Kubernetes networking with Cilium).

Related topics include the original Berkeley Packet Filter, extended BPF, XDP, and various in-kernel tracing and observation tools that rely on eBPF for performance and flexibility.