Microsoft To Bring eBPF To Windows

eBPF (Extended Berkeley Packet Filter) is a programmable, high-performance packet-filtering engine built into the Linux kernel, into which you can load custom programs for controlling and monitoring the behaviour of the network stack. Now Microsoft wants to bring some of the same networking goodness to Windows <https://www.theregister.com/2021/05/11/microsoft_linux_ebpf/>: Microsoft, having force fed Windows with Linux supplements in recent years, has moved on to embracing and extending Linux tooling. eBPF programs have proven useful on Linux for denial-of-service defense and system observability. And since there's been interest in adapting the technology to other operating systems, Microsoft has decided to give the software a shot at Windows. Fans of the well-known “Three Es” might note that the platform being embraced and extended here is Windows.

I wrote:
eBPF (Extended Berkeley Packet Filter) is a programmable, high-performance packet-filtering engine built into the Linux kernel, into which you can load custom programs for controlling and monitoring the behaviour of the network stack.
I was wrong. It’s a whole lot more than that. It can also hook into filesystem access as well, among other things. Here <https://kinvolk.io/blog/2021/04/extending-systemd-security-features-with-ebpf/> are some examples of it in use with systemd to provide various security features.
participants (1)
-
Lawrence D'Oliveiro