More surprising to me than the BPF VM itself is the optimizing compiler for it that lives in libpcap.