eBPF is just an in-kernel VM. You can do a lot of things with it, which makes it hard to figure out what to do with it. Original BPF is in most Unix kernels, i

eBPF is just an in-kernel VM. You can do a lot of things with it, which makes it hard to figure out what to do with it. Original BPF is in most Unix kernels, it was just a way of writing simple packet filtering programs that run in-kernel. For example, tcpdump is effectively just a frontend that emits BPF bytecode. eBPF expands the capabilities of the VM, but it still has tight restrictions on what can run: no unbounded loops, arbitrary memory access, etc. I would recommend trying out bpftrace as a first step: https://github.com/iovisor/bpftrace https://github.com/iovisor/bpftrace