BPF - the forgotten bytecode

This post introduces the Berkeley Packet Filter (BPF) as a powerful and flexible mechanism for packet filtering within the kernel. It details how BPF, originally developed for `tcpdump`, has evolved and is now utilized by Cloudflare for advanced threat management. Specifically, it highlights the use of the `xt_bpf` iptables module to apply custom BPF bytecode for precisely matching and dropping malicious traffic, such as DNS queries for specific domains or subdomains, and demonstrates its effectiveness in handling massive packet floods.