# BPF: the forgotten bytecode

DevFeed: [BPF: the forgotten bytecode](<https://devfeed.tech/articles/bpf-the-forgotten-bytecode-38935.md>)

Original publisher: [Read original article](<https://idea.popcount.org/2014-05-21-bpf-the-forgotten-bytecode>)

Author: Marek

Published: 2014-05-20T22:00:00Z

Content type: tutorial

Language: en

Sources: [Marek Majkowski](<https://devfeed.tech/sources/marek-majkowski.md>)

Topics: [Kernel](<https://devfeed.tech/topics/kernel.md>), [networking](<https://devfeed.tech/topics/networking.md>), [debugging](<https://devfeed.tech/topics/debugging.md>), [Parser](<https://devfeed.tech/topics/parser.md>), [pretty printing](<https://devfeed.tech/topics/pretty-printing.md>), [systems](<https://devfeed.tech/topics/systems.md>)

Tags: [article](<https://devfeed.tech/tags/article.md>), [blog](<https://devfeed.tech/tags/blog.md>), [debugging](<https://devfeed.tech/tags/debugging.md>), [filter](<https://devfeed.tech/tags/filter.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [network](<https://devfeed.tech/tags/network.md>), [pretty-printing](<https://devfeed.tech/tags/pretty-printing.md>)

## AI overview

This article explains the history and operation of the Berkeley Packet Filter (BPF), including how tcpdump parses filter expressions into BPF bytecode, attaches the filter to a network interface, and pretty-prints the resulting packets. It also describes kernel-level packet filtering for network debugging.

## Source excerpt

BPF: the forgotten bytecode This article was originally published on the CloudFlare blog: Every once in a while I run into an obscure computer technology that is a hidden gem, which over the years has become mostly forgotten. This is exactly how I feel about the tool and its kernel counterpart the packet filter interface. For example, say you run: For most of us this command is pure magic, almost nobody understands what happens behind the scenes.