Zero-copy mechanism and libpcap… here is a solution to the problem.
Zero-copy mechanism and libpcap
Is it possible to use the zero-copy packet mechanism to read packets using libpcap on Linux?
(I’m using CentOS 6.2)
If yes, can I see any code samples?
Solution
Yes, libpcap
1.0 onwards will do, although later libpcap versions have fixed some bugs, so the later you use libpcap versions, the better. Code written to the standard libpcap API will use zero-copy capture on Linux using libpcap 1.0 and later.
(Netsniff-ng has its own code to capture packets instead of using libpcap.) )