Using Device Polling and More to Improve Packet Capture
Luca Deri, in Improving Passive Packet Capture: Beyond Device Polling (pdf) shows
radical (and appalling) differences in packet capture performance among Windows, FreeBSD, and Linux machines, due to
differences in device drivers. The paper recommends use of device polling, and the author also implemented a ring-buffer version of libpcap.
[via TaoSecurity]
