eBPF work on Windows

Last updated: February 8, 2026Reviewed date: February 8, 2026Reading time: 3 min read

Patient Tools

Read, save, and share this guide

Use these quick tools to make this medical article easier to read, print, save, or share with a family member.

Patient Mode

Understand this article easily

Switch between simple English and easy Bangla patient notes. This is for education and does not replace a doctor consultation.

For severe symptoms, danger signs, pregnancy, child illness, or sudden worsening, seek urgent medical care.

বাংলা রোগী নোট এখনো যোগ করা হয়নি। পোস্ট এডিটরে “RX Bangla Patient Mode” বক্স থেকে সহজ বাংলা সারাংশ যোগ করুন।

এই তথ্য শিক্ষা ও সচেতনতার জন্য। এটি ডাক্তারি পরীক্ষা, রোগ নির্ণয় বা প্রেসক্রিপশনের বিকল্প নয়।

Article Summary

eBPF is a well-known but revolutionary technology—providing programmability, extensibility, and agility. eBPF has been applied to use cases such as denial-of-service protection and observability. Over time, a significant ecosystem of tools, products, and experience has been built up around eBPF. Although support for eBPF was first implemented in the Linux kernel, there has been increasing interest in allowing eBPF to be used on other operating systems...

Key Takeaways

This article explains Architectural overview in simple medical language.
This article explains Is this a fork of eBPF? in simple medical language.
This article explains Does this provide app compatibility with eBPF programs written for Linux? in simple medical language.
This article explains Learn more and contribute in simple medical language.

Educational health guideWritten for patient understanding and clinical awareness.

Reviewed content workflowUse writer and reviewer profiles for stronger trust.

Emergency safety firstUrgent warning signs are highlighted below.

Seek urgent medical care if you notice

These warning signs are general safety guidance. Local emergency numbers and clinical judgment should always come first.

Severe symptoms, breathing difficulty, fainting, confusion, or rapidly worsening illness.
New weakness, severe pain, high fever, or symptoms after a serious injury.
Any symptom that feels urgent, unusual, or unsafe for the patient.

Emergency now

Use emergency care for severe, sudden, rapidly worsening, or life-threatening symptoms.

See a doctor

Book a professional medical evaluation if symptoms persist, worsen, recur often, affect daily activities, or occur in a high-risk patient.

Learn safely

Use this article to understand possible causes, tests, treatment options, prevention, and questions to ask your clinician.

Before reading

RX Patient Tools

Use these quick guides before reading the article, or return to them when you need help preparing questions for a doctor.

Start here Choose the right pathway for symptoms, reports, medicines, or urgent warning signs. Disease article roadmap Read this topic step by step: meaning, symptoms, warning signs, diagnosis, treatment, prevention, and follow-up. Treatment planner Prepare questions about treatment choices, benefits, risks, side effects, and follow-up. Family & caregiver guide Organize symptoms, reports, medicines, questions, and follow-up safely. Nutrition & diet guide Prepare food, hydration, supplement, and medicine-timing questions safely. Prevention guide Organize risk factors, protective habits, screening, and warning signs. Recovery guide Prepare a safe plan for activity, rehabilitation, warning signs, and follow-up.

Today we are excited to announce a new Microsoft open source project to make eBPF work on Windows 10 and Windows Server 2016 and later. The ebpf-for-windows project aims to allow developers to use familiar eBPF toolchains and application programming interfaces (APIs) on top of existing versions of Windows. Building on the work of others, this project takes several existing eBPF open source projects and adds the “glue” to make them run on Windows.

We are announcing this now while the project is still relatively early in development because our goal is to work in collaboration with the robust eBPF community to make sure that eBPF works great on Windows, and everywhere else.

Architectural overview

The following diagram illustrates the architecture of this project and related components:

eBPF work on Windows

As shown in the diagram, existing eBPF toolchains such as clang can be used to generate eBPF bytecode from source code in various languages. The resulting bytecode can then be used by any application or manually through the Windows netsh command-line tool, both of which use a shared library that exposes Libbpf APIs, though this work is still in progress.

The library sends the eBPF bytecode to a static verifier (the PREVAIL verifier) that is hosted in a user-mode protected process, which is a Windows security environment that allows a kernel component to trust a user-mode daemon signed by a key that it trusts. If the bytecode passes all the verifier’s safety checks, the bytecode can be either loaded into the uBPF interpreter running in a Windows kernel-mode execution context or compiled by the uBPF just-in-time (JIT) compiler and have native code loaded into the kernel-mode execution context.

eBPF programs installed into the kernel-mode execution context can attach to various hooks to handle events and call various helper APIs exposed by the eBPF shim, which internally wraps public Windows kernel APIs, allowing the use of eBPF on existing versions of Windows. So far, two hooks (XDP and socket bind) have been added, and though these are networking-specific hooks, we expect many more hooks and helpers, not just networking-related, will be added over time.

Is this a fork of eBPF?

In short, no.

The eBPF for Windows project leverages existing open source projects, including the IOVisor uBPF project and the PREVAIL verifier, running them on top of Windows by adding the Windows-specific hosting environment for that code.

Does this provide app compatibility with eBPF programs written for Linux?

The intent is to provide source code compatibility for code that uses common hooks and helpers that apply across Operating System ecosystems.

Linux provides many hooks and helpers, some of which are very Linux specific (using Linux internal data structs, for example) that would not be applicable to other platforms. Other hooks and helpers are generically applicable, and the intent is to support them for eBPF programs.

Similarly, the eBPF for Windows project exposes Libbpf APIs to provide source code compatibility for applications that interact with eBPF programs.

Learn more and contribute

The ebpf-for-windows project brings the power of eBPF to Windows users and is intended to eventually reside in a community-governed foundation in the eBPF ecosystem. With your input and help, we can get there.

Reach out to us or create an issue on GitHub. We’re excited to continue to refine and extend ebpf-for-windows so that everyone can benefit from this project. We are eager to see what you discover with this project and how it evolves.

Safety note: This is not a prescription or diagnosis. For severe symptoms, pregnancy danger signs, children with serious illness, chest pain, breathing difficulty, stroke-like weakness, or major injury, seek urgent care.

Which doctor may help?

Start with a registered doctor or the nearest qualified health center.

What to tell the doctor

Write when the problem started and how it changed.
Bring old prescriptions, investigation reports, and current medicines.
Write allergies, pregnancy status, diabetes, kidney/liver disease, and major past illnesses.
Bring one family member if the patient is weak, elderly, confused, or a child.

Questions to ask

What is the most likely cause of my symptoms?
Which danger signs mean I should go to hospital quickly?
Which tests are necessary now, and which can wait?
How should I take medicines safely and what side effects should I watch for?
When should I come for follow-up?

Tests to discuss

Vital signs: temperature, pulse, blood pressure, oxygen saturation
Basic physical examination by a clinician
CBC, urine test, blood sugar, or imaging only when clinically needed

Avoid these mistakes

Do not use antibiotics, steroid tablets/injections, or strong painkillers without proper medical advice.
Do not hide pregnancy, kidney disease, ulcer, allergy, or blood thinner use.
Do not delay emergency care when danger signs are present.

Medicine safety and first-aid guide

This section is for patient education only. It does not replace a doctor, pharmacist, or emergency care.

Safe first steps

Avoid heavy lifting, sudden bending, and prolonged bed rest.
Use comfortable posture and gentle movement as tolerated.
Discuss physiotherapy, X-ray, or MRI only when clinically needed.

OTC medicine safety

For mild back pain, pain-relief medicine may be discussed with a doctor or pharmacist.
Avoid repeated painkiller use if you have kidney disease, stomach ulcer, uncontrolled blood pressure, or are taking blood thinners.

Avoid these mistakes

Do not start antibiotics without a proper medical decision.
Do not use steroid tablets or injections casually for quick relief.
Do not delay emergency care because of home remedies.

Get urgent help if

Back pain with leg weakness, numbness around private area, loss of urine/stool control, fever, cancer history, or major injury needs urgent care.

Medicine names, dose, and timing must be decided by a qualified clinician or pharmacist after checking age, pregnancy, allergy, other diseases, and current medicines.

For rural patients and family caregivers

Patient health record and symptom diary

Write your symptoms, medicines already taken, test results, and questions before visiting a doctor. This note stays on your device unless you print or copy it.

Doctor to discuss: Doctor / qualified healthcare provider

Tests to discuss with doctor

Basic vital signs: temperature, pulse, blood pressure, oxygen level if needed
Relevant blood, urine, imaging, or specialist tests only after clinical assessment

Questions to ask

What is the most likely cause of my symptoms?
Which warning signs mean I should go to emergency care?
Which tests are really needed now?
Which medicines are safe for my age, pregnancy status, allergy, kidney/liver/stomach condition, and current medicines?

Emergency warning signs such as chest pain, severe breathing difficulty, sudden weakness, confusion, severe dehydration, major injury, or loss of bladder/bowel control need urgent medical care. Do not wait for online information.

Go to emergency care if you notice:

Severe or rapidly worsening symptoms
Breathing difficulty, chest pain, fainting, confusion, severe weakness, major injury, or severe dehydration

Doctor / service to discuss: Qualified healthcare provider; specialist depends on symptoms and examination.

Step 1
Check danger signs first

If danger signs are present, seek emergency care and do not wait for online information.
Step 2
Record the symptom story

Write when symptoms started, severity, medicines already taken, allergies, pregnancy status, and test results.
Step 3
Visit a qualified clinician

A doctor, nurse, or qualified healthcare provider can examine you and decide which tests or treatment are needed.
Step 4
Do only useful tests

Do tests after clinical assessment. Avoid unnecessary tests, random antibiotics, or repeated medicines without diagnosis.
Step 5
Follow up and return early if worse

If symptoms worsen, new warning signs appear, or treatment is not helping, return for review quickly.

Rural patient practical tips

Take a written symptom diary and all previous prescriptions/test reports.
Do not hide medicines already taken, even herbal or over-the-counter medicines.
Ask which warning signs mean urgent referral to hospital.

This roadmap is for education. A real diagnosis and treatment plan requires history, examination, and clinical judgment.

RX Patient Help

Ask a health question safely

Write your symptom story. A health professional or site editor can review it before any answer is prepared. This box is not for emergency care.

Emergency first: Severe chest pain, breathing trouble, unconsciousness, stroke signs, severe injury, heavy bleeding, or rapidly worsening symptoms need urgent local medical care now.

Website

Name or nickname Phone / contact District / area Age group Sex Severity today

Main symptoms How long has it been happening? Medicines already taken Tests already done Your question 0/1200

Frequently Asked Questions

Architectural overview The following diagram illustrates the architecture of this project and related components: As shown in the diagram, existing eBPF toolchains such as clang can be used to generate eBPF bytecode from source code in various languages. The resulting bytecode can then be used by any application or manually through the Windows netsh command-line tool, both of which use a shared library that exposes Libbpf APIs, though this work is still in progress. The library sends the eBPF bytecode to a static verifier (the PREVAIL verifier) that is hosted in a user-mode protected process, which is a Windows security environment that allows a kernel component to trust a user-mode daemon signed by a key that it trusts. If the bytecode passes all the verifier’s safety checks, the bytecode can be either loaded into the uBPF interpreter running in a Windows kernel-mode execution context or compiled by the uBPF just-in-time (JIT) compiler and have native code loaded into the kernel-mode execution context. eBPF programs installed into the kernel-mode execution context can attach to various hooks to handle events and call various helper APIs exposed by the eBPF shim, which internally wraps public Windows kernel APIs, allowing the use of eBPF on existing versions of Windows. So far, two hooks (XDP and socket bind) have been added, and though these are networking-specific hooks, we expect many more hooks and helpers, not just networking-related, will be added over time. Is this a fork of eBPF?

In short, no. The eBPF for Windows project leverages existing open source projects, including the IOVisor uBPF project and the PREVAIL verifier, running them on top of Windows by adding the Windows-specific hosting environment for that code.

Does this provide app compatibility with eBPF programs written for Linux?

The intent is to provide source code compatibility for code that uses common hooks and helpers that apply across Operating System ecosystems. Linux provides many hooks and helpers, some of which are very Linux specific (using Linux internal data structs, for example) that would not be applicable to other platforms. Other hooks and helpers are generically applicable, and the intent is to support them for eBPF programs. Similarly, the eBPF for Windows project exposes Libbpf APIs to provide source code compatibility for…

References

Add references, clinical guidelines, textbooks, journal articles, or trusted medical sources here. You can edit this area from the RX Article Professional Blocks panel.

eBPF work on Windows

Read, save, and share this guide

Understand this article easily

Article Summary

Key Takeaways