[$] Writing network flow dissectors in BPF
Network packet headers contain a great deal of information, but the
kernel often only needs a subset of that information to be able to perform
filtering or associate any given packet with a flow. The piece of code that
follows the different layers of packet encapsulation to find the important
data is called a flow dissector. In current Linux kernels, the flow
dissector
is written in C. A patch set has been
proposed recently to implement it in BPF with the clear goal of improving
security, flexibility, and maybe even performance.