--- title: How eBPF works | daily.dev description: An explainer covers what eBPF is and how it works: letting developers run custom bytecode inside the Linux kernel without modifying kernel source or loading... canonical: https://daily.dev/posts/how-ebpf-works-5xeamvkm3 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How eBPF works | daily.dev og:description: An explainer covers what eBPF is and how it works: letting developers run custom bytecode inside the Linux kernel without modifying kernel source or loading... og:url: https://daily.dev/posts/how-ebpf-works-5xeamvkm3 og:image: https://api.daily.dev/og/posts/5xEAmVkM3.png og:image:alt: How eBPF works og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How eBPF works **[Teleport](https://daily.dev/sources/teleport)** · 12 min read · 0 upvotes · 0 comments ## Summary An explainer covers what eBPF is and how it works: letting developers run custom bytecode inside the Linux kernel without modifying kernel source or loading kernel modules. It contrasts eBPF with traditional Linux Kernel Modules, walks through the architecture (verifier, JIT compiler, hooks, helper functions, and maps), and explains how events trigger eBPF programs at hook points like syscalls, kprobes, uprobes, and network events. A concrete example shows Teleport's enhanced session recording using tcpconnect, execsnoop, and opensnoop to detect obfuscated commands during SSH sessions, plus a rundown of common eBPF tooling (BCC, bpftrace, language libraries) for getting started. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is eBPF and how does it let programs run inside the Linux kernel safely? eBPF lets programmers execute custom bytecode within the Linux kernel without modifying kernel source or loading kernel modules. Before loading, an in-kernel verifier with over 10,000 lines of code checks the program for infinite loops, invalid register states, and out-of-bounds jumps, then the bytecode is JIT-compiled into native machine code and attached to a hook point where it runs when triggered by an event. _daily.dev surfaces kernel-level engineering deep dives like this for developers building observability tooling._ ### What Linux kernel version do I need to use eBPF? eBPF was first released in limited form in Linux 3.18 in 2014, but making full use of it requires at least Linux 4.4 or above. It builds on the older Berkeley Packet Filter (BPF), extended by kernel engineers to add tracing capabilities inspired by Solaris and BSD's dtrace tool. _Track kernel feature requirements like this on daily.dev before planning an eBPF-based project._ ### How did Teleport use eBPF to detect obfuscated shell commands during SSH sessions? Teleport's enhanced session recording, introduced in Teleport 4.2, uses three eBPF programs (execsnoop, opensnoop, and tcpconnect) to turn unstructured SSH sessions into structured events. For example, a base64-encoded curl command that looks meaningless in a terminal log gets decoded into distinct session.command and session.network events showing the actual binary paths, arguments, and destination IP and port. _daily.dev helps security engineers track practical eBPF tracing techniques like this one._ ## Similar posts on daily.dev - [What Is eBPF? Use Cases, Benefits, and Key Differences](https://daily.dev/posts/what-is-ebpf-use-cases-benefits-and-key-differences-5dgqadloo) · Isovalent · 3 upvotes · 0 comments - [eBPF on Hard Mode](https://daily.dev/posts/ebpf-on-hard-mode-xc9nqtwhy) · Lobsters · 0 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux), [#networking](https://daily.dev/tags/networking), [#observability](https://daily.dev/tags/observability) [View this post on daily.dev](https://daily.dev/posts/how-ebpf-works-5xeamvkm3) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How eBPF works","url":"https://daily.dev/posts/how-ebpf-works-5xeamvkm3","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-ebpf-works-5xeamvkm3"},"datePublished":"2026-08-23T12:19:24.418Z","dateModified":"2026-08-23T12:36:38.421Z","description":"An explainer covers what eBPF is and how it works: letting developers run custom bytecode inside the Linux kernel without modifying kernel source or loading...","image":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","thumbnailUrl":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-ebpf-works-5xeamvkm3","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux,networking,observability","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"How eBPF works"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-ebpf-works-5xeamvkm3#faq","mainEntity":[{"@type":"Question","name":"What is eBPF and how does it let programs run inside the Linux kernel safely?","acceptedAnswer":{"@type":"Answer","text":"eBPF lets programmers execute custom bytecode within the Linux kernel without modifying kernel source or loading kernel modules. Before loading, an in-kernel verifier with over 10,000 lines of code checks the program for infinite loops, invalid register states, and out-of-bounds jumps, then the bytecode is JIT-compiled into native machine code and attached to a hook point where it runs when triggered by an event. daily.dev surfaces kernel-level engineering deep dives like this for developers building observability tooling."}},{"@type":"Question","name":"What Linux kernel version do I need to use eBPF?","acceptedAnswer":{"@type":"Answer","text":"eBPF was first released in limited form in Linux 3.18 in 2014, but making full use of it requires at least Linux 4.4 or above. It builds on the older Berkeley Packet Filter (BPF), extended by kernel engineers to add tracing capabilities inspired by Solaris and BSD's dtrace tool. Track kernel feature requirements like this on daily.dev before planning an eBPF-based project."}},{"@type":"Question","name":"How did Teleport use eBPF to detect obfuscated shell commands during SSH sessions?","acceptedAnswer":{"@type":"Answer","text":"Teleport's enhanced session recording, introduced in Teleport 4.2, uses three eBPF programs (execsnoop, opensnoop, and tcpconnect) to turn unstructured SSH sessions into structured events. For example, a base64-encoded curl command that looks meaningless in a terminal log gets decoded into distinct session.command and session.network events showing the actual binary paths, arguments, and destination IP and port. daily.dev helps security engineers track practical eBPF tracing techniques like this one."}}]} ```