Linux has (at this point) a variety of hooks you can attach eBPF programs to; bpfilter is one of them. The naming is confusing. BPF stands for Berkeley Packet

Linux has (at this point) a variety of hooks you can attach eBPF programs to; bpfilter is one of them. The naming is confusing. BPF stands for Berkeley Packet Filter, but its original use case was only for capturing a copy of network packets for inspection (think tcpdump/Wireshark); the "filter" was just used to select which packets should be captured. bpfilter, on the other hand, applies eBPF to firewalling – in other words, a more typical definition of "packet filter".