eBPF stands for extended Berkeley Packet Filter, but you probably already knew that. The old BPF system is used to filter packets on raw sockets and it has been extended to increase its area of usage. It is indeed now possible to plug an eBPF filter in various places of the Linux kernel to extract information or act on kernel behavior. And eBPF renders this possible by adding multiple kernel and userspace exchange methods.
There are 3 ways eBPF can be used in Suricata. In all of them, the eBPF filter can access the packet data and parse them to extract information.
Download this white paper to learn all about these three ways eBPF can be used in Suricata.