eBPF and XDP for Fast Packet Processing: A Practical Intro
XDP runs your code in the driver, before the kernel builds an sk_buff — the fastest place to touch a packet in Linux. What XDP is, a working drop program, how to load it and inspect maps, and where it fits versus iptables and DPDK.