1. Origin of BPF (1993–1997)
- 1993: BPF (Berkeley Packet Filter) was introduced by Steven McCanne and Van Jacobson.
- Designed to filter network packets inside the kernel efficiently.
- Used a 32-bit, assembly-like instruction set.
- 1997: Added to Linux (kernel 2.1.75) and used by tools like
tcpdump.
Example: IPv4 Packet Filtering
ldh [12] ; Read EtherType
jeq #ETHERTYPE_IP, L1, L2 ; Check for IPv4
L1: ret #TRUE ; Accept
L2: ret #0 ; Reject
The filter reads bytes 12–13 of an Ethernet frame. If EtherType is 0x0800 (IPv4), the packet is accepted for capture; otherwise, it is rejected.
2. BPF → eBPF (2014)
2014: Linux kernel 3.18 introduced extended BPF (eBPF).
Major improvements:
- 64-bit instruction set: Redesigned for better performance on modern CPUs.
- eBPF Maps: Data structures for sharing information between kernel and user-space programs.
bpf()syscall: Allows user-space applications to load and manage eBPF programs and maps.- BPF Helpers: Kernel-provided functions that eBPF programs can call to perform supported operations.
- eBPF Verifier: Checks program safety before execution, including memory access and termination.
3. Evolution of eBPF
| Year | Milestone |
|---|---|
| 2005 | Kprobes introduced in Linux for kernel debugging and tracing. |
| 2014 | eBPF foundation introduced: verifier, maps, and bpf() syscall. |
| 2015 | eBPF gained kprobe support, enabling powerful kernel tracing. |
| 2016 | eBPF adopted in production; Netflix used it for observability, and Cilium was announced for container networking. |
| 2017–2018 | Facebook’s Katran demonstrated high-performance eBPF/XDP load balancing. |
| 2018 | eBPF became a separate kernel subsystem; BTF was introduced for portability. |
| 2020 | BPF LSM enabled eBPF-based Linux security enforcement. |
4. Important eBPF Features
- Kprobes: Attach eBPF programs to kernel functions for tracing.
- XDP (eXpress Data Path): Process and filter network packets early for high performance.
- BTF (BPF Type Format): Provides type information that improves portability across kernel versions.
- BPF LSM: Attach security programs to Linux Security Module hooks.
- Tail Calls: Allow an eBPF program to transfer execution to another eBPF program.
Program complexity: Early eBPF had a 4,096-instruction limit. Modern privileged eBPF loading supports a verifier complexity limit of up to 1 million processed instructions, which is different from simply allowing one million instructions in a program.
5. BPF vs. eBPF Naming
Originally:
- BPF = Berkeley Packet Filter (network packet filtering).
- eBPF = Extended BPF (networking, tracing, security, and observability).
Today, BPF and eBPF are often used interchangeably.
Linux kernel code still uses names such as:
bpf()— System callbpf_*— Helper functionsBPF_PROG_TYPE_*— Program types
Key Takeaway
BPF started as a network packet-filtering technology in 1993 and evolved into eBPF in 2014.
Modern eBPF enables safe, programmable functionality inside the Linux kernel without modifying kernel source code.
Its three major application areas are:
- Networking — Packet filtering, routing, load balancing.
- Observability — Monitoring system calls, processes, and performance.
- Security — Detecting suspicious activity and enforcing security policies.