eBPF is used to safely and efficiently extend the kernel's capabilities without requiring changing the kernel source code or loading kernel modules/extensions.
eBPF gives you information at a high level on Layers 3, 4 and 7, allowing you to see all network communication and correlate it with processes and specific applications that are communicating on those ports.
[
add
]
[
|
|
...
]