What is bpf filter?

BPF stands for Berkeley Packet Filter. It's a powerful language used to filter network traffic.

Think of it as a set of precise instructions for your computer's kernel. You write a filter expression, and the kernel examines each network packet against it. Only packets that match your expression are passed on to an application, like a network analyser. Everything else is immediately discarded.

This process is remarkably efficient. Because the filtering happens deep within the operating system, it saves a tremendous amount of processing power. Unwanted data never has to be copied or processed by your tools.

You've almost certainly used it without realising. The capture filter syntax in popular tools like tcpdump and Wireshark is classic BPF. For instance, a filter like tcp port 443 tells the system to only show you secure web traffic, ignoring all the other noise.