A few things: * Non intrusive: meaning one can snoop info of application without changing application code. * Deep visibility: function level and syscall/kern

A few things: * Non intrusive: meaning one can snoop info of application without changing application code. * Deep visibility: function level and syscall/kernel functions reveal more context and are more accurate in a lot of cases. * Low overhead: everything runs inside kernel space, no context switching compared to other kernel based/aided tracing. * Expressiveness: eBPF is fairly expressive, can do many things that usually are exclusive to high level programming languages.