Development of eBPF probe for IP network monitoring to meet requirements of Alternate Marking methodology (RFC8321), including the high processing speed. The thesis flow includes a code writing phase where the problems relating to the program functionalities have been addressed, together with the issues encountered during the development of the eBPF code itself. After the work, a testing phase has been carried out with an emulated two-node network consisting of two servers directly connected with 10 Gbps links and the software running on them and collecting packets generated by a Test Center (device used for the packet generation), set to produce bidirectional flows crossing the servers.