I don't see a reason to implement anything like this without using bpf.
BPF is so cool, yet so inaccessible so most tinkerers. If it had Python bindings I'd start using it today, but as is - it's esoteric.
Well clear your schedule, it's most commonly used interface is through it's python bindings (a library called BCC):