On: eBPF on Windows

[tptacek]

Point of order: BPF wasn't written simply for tcpdump; it's part of a line of research on using PL runtimes to configure and operate networking stacks; so, right after McCanne's BPF paper, you get MPF, which is proposed to do all of demux for Mach.

[bostonsre → tptacek]

Neat, did not know that.

[tptacek → bostonsre]

A long post I wrote about this stuff, taking the history back to the Xerox Alto:

https://fly.io/blog/bpf-xdp-packet-filters-and-udp/