eBPF is the Linux kernel technology used for dynamic tracing and packet filtering. It lets verified programs attach to kernel hook points and run when relevant events occur, extending kernel behavior without modifying the kernel’s source code or loading a traditional kernel module.
The technology evolved from the Berkeley Packet Filter, originally designed to filter captured network packets efficiently. Modern eBPF expanded far beyond networking: tools can use it for performance analysis, observability, security monitoring, traffic processing, and tracing kernel or user-space activity. A verifier checks programs before they run, while just-in-time compilation can translate them into native machine instructions.
The main trap is treating eBPF as interchangeable with every Linux diagnostic or networking tool. strace is a user-space system-call tracing utility, while iptables and netfilter are parts of Linux firewall and packet-processing infrastructure. eBPF can complement or, in some cases, implement functions associated with those tools, but it is the underlying programmable kernel technology described by the question. The “e” originally referred to “extended,” although eBPF is now commonly used as the technology’s name.