How simple the Linux kernel BPF works

BPF is used for a lot of packet capture programs, in Linux, the general kernel is automatically compiled into the Af_packet driver, so only need to configure a packet socket in the user configuration, and then the filter configuration into the kernel, using setsockopt so_ Attach_filter command, this filter is formulated in user space, such as the tcpdump application, tcpdump and the kernel BPF filter relationship is similar to iptables and netfilter relationship, but netfilter to achieve the match /target, and the target of BPF is to choose whether or not to

How simple the Linux kernel BPF works