2026-11-05 –, Room 1 Language: English
The Dataplane Development Kit (DPDK) is used by many proprietary and open source network infrastructure products. One limitation of the DPDK is that since it bypasses the kernel, most standard packet capture tools (such as tcpdump and wireshark) won't work as expected. I will cover six alternative ways to capture packets with DPDK and what the tradeoffs are in terms of integration, performance, and features.
The six different ways (in no particular order) are:
DPDK's builtin pdump framework which is used by the tools dpdk-pdump and dpdk-dumpcap.
libpcap-dpdk - integration of DPDK backend into libpcap
rpcap - remote capture protocol support in DPDK; example targeted for 26.11 release
grout libpcap - integration of libpcap in graph-route project
netcap - eBPF trace hook support for packet capture
extcap - DPDK integration with extcap; library targeted for 26.11 release
Will cover all of them for comparison and do performance tests on those that are similar.
Stephen Hemminger is a member of the DPDK technical board who wrote the pcapng library and dpdk-dumpcap tool. He worked for many years at Microsoft, Brocade, and Linux Foundation contributing to networking related open source projects including the Linux kernel. Since retirement he spends more time on open source! He co-maintains iproute2 and several DPDK components.