eBPF, or Extended Berkeley Packet Filter, made its way to user space in the Linux kernel when version 3.18 dropped in December 2014. While the behind-the-scenes overhauling of the original BPF setup began in kernel version 3.15, version 3.18 was the real deal because it presented the eBPF virtual machine and the bpf() system call directly to user space. As a result, developers were able to run custom eBPF programs without messing with kernel source code.
In 1992-1993, the classic BPF (cBPF), dreamt up by Steven McCanne and Van Jacobson, came on the scene for packet filtering – this is what got tools like tcpdump going. The original version was rolled into Linux 2.1 in 1997. Then, in 2014, Alexei Starovoitov and Daniel Borkmann whipped up eBPF, which updated cBPF to fit modern 64-bit hardware and included a safety checker. They made their debut with Linux 3.18.
Over the following years, from 2015-2016, eBPF kept growing and became easier to use. Along came the BPF Compiler Collection (BCC) which lets you write eBPF programs using C. By Linux version 4.4, its usefulness in tracing, security, and advanced networking really took off, making it ready for wider use in real-world setups.
