What is eBPF and how does it extend kernel functionality?

Extended Berkeley Packet Filter (eBPF) allows running sandboxed programs in kernel space without modifying kernel or loading modules. Programs are verified for safety before execution. Use cases: networking (XDP for fast packet processing), security (syscall filtering), tracing (performance monitoring), observability. Programs attach to hooks (syscalls, network events, tracepoints). Maps share data between eBPF and user space. Tools: bpftrace, bcc, Cilium. Revolutionizes observability and networking.