.Extended Berkeley Packet Filter is supported in RHEL 9 The *Extended Berkeley Packet Filter (eBPF)* is an in-kernel virtual machine that allows code execution in the kernel space, in the restricted sandbox environment with access to a limited set of functions. The virtual machine executes a special assembly-like code. The *eBPF* bytecode first loads to the kernel. Then the bytecode is verified and translated to the native machine code with just-in-time compilation. Finally, the virtual machine executes the code. Red Hat ships numerous components that utilize the *eBPF* virtual machine. In RHEL 9, these components include: * The *BPF Compiler Collection (BCC)* package, which provides tools for I/O analysis, networking, and monitoring of Linux operating systems using *eBPF*. * The *BCC* library, which allows the development of tools similar to those provided in the *BCC* tools package. * The `bpftrace` tracing language. * The `libbpf` package, which is crucial for `bpf` development and `bpf`-related applications like `bpftrace`. ** The `XDP` and `AF_XDP` API parts of the `libbpf` library are not supported and may be removed in a future release. * The *eBPF for Traffic Control (tc)* feature, which enables programmable packet processing inside the kernel network data path. * The *eXpress Data Path (XDP)* feature, which provides access to the received packets before the kernel networking stack processes them. Red Hat supports *XDP* only if it is used through the `libxdp` library. * The `xdp-tools` package, which contains user-space support utilities for the *XDP* feature and is supported on the AMD64 and Intel64 CPU architectures. The `xdp-tools` package includes: ** The `libxdp` library. ** The `xdp-loader` utility for loading XDP programs. ** The `xdp-filter` example program for packet filtering. ** The `xdpdump` utility for capturing packets from a network interface with *XDP* enabled. The `xdpdump` utility is currently supported only on AMD64 and Intel64 CPU architectures. It is available for other architectures as Technology Preview. * The `AF_XDP` socket for connecting the *eXpress Data Path (XDP)* path to user-space.