eBPF programs are bytecode that runs on a virtual machine in the kernel. The programs are limited by number of instructions and computational complexity (they must halt). These programs can transfer data back to user space using maps, which are simple data structures for passing things like lists of ips, for example. These eBPF programs are attached to probes in the kernel where they can gather information at the probe point. XDP is essentially a probe before any of the networking stack has happened. An XDP eBPF program can read and manipulate raw packet data, allowing you to process the packet as fast as your network card will allow, before that data is ever seen by the slow kernel networking code.
Unlike other options like DPDK, eBPF programs are tightly integrated in the kernel. They allow you to write kernel code that the kernel can safely run. They are simple to write, easy to install (it's just a syscall) and there are tools in Rust and other languages (check out BCC) that allow you to compile to eBPF bytecode from various languages. You're also not just limited to networking. eBPF programs can hook in to many places in the kernel, and there are already efforts to build new system performance tools using eBPF.
Unlike other options like DPDK, eBPF programs are tightly integrated in the kernel. They allow you to write kernel code that the kernel can safely run. They are simple to write, easy to install (it's just a syscall) and there are tools in Rust and other languages (check out BCC) that allow you to compile to eBPF bytecode from various languages. You're also not just limited to networking. eBPF programs can hook in to many places in the kernel, and there are already efforts to build new system performance tools using eBPF.