Re: RFC: a loadable plugin framework for external capture backends

[Stephen Hemminger via tcpdump-workers <tcpdump-workers () lists tcpdump org>]

> --- Begin Message ---
>
>
> From: Stephen Hemminger <stephen () networkplumber org>
>
> Date: Thu, 1 Oct 2026 15:51:46 -0700
>
> On Thu, 01 Oct 2026 16:33:58 -0400
> Michael Richardson <mcr () sandelman ca> wrote:
>
> >     > Existing remote-capture solutions such as rpcapd do not help here
> >     > either: they require the dataplane to write every captured packet to a
> >     > TCP/UDP socket,  
> >
> > The rpcapd solution should not be horrible if the percent of traffic is low,
> > and the BPF program runs inside of the user-space engine.
> > This might be the best story for "casual" captures.
> > It won't due for someone trying to eat 100Gb/s of live DNS traffic for
> > analysis.   https://adam.pages.nic.cz/dns-probe/Running.html does not, AFAIK,
> > use libpcap for these preformance reasons, offering TPACKET or DPDK integrations.
>
> Rpcap over unix domain sockets can be faster and solve some of the security
> issues?
>
> --- End Message ---
_______________________________________________
tcpdump-workers mailing list -- tcpdump-workers () lists tcpdump org
To unsubscribe send an email to tcpdump-workers-leave () lists tcpdump org
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s