https://blog.yadutaf.fr/2017/07/28/tracing-a-packet-journey-using-linux-tracepoints-perf-ebpf/

Very interesting. The key is that eBPF programs can be attached to tracepoints.