I'm looking at the packetbeat document, and it declares af_packet has better performance than pcap.
Do we have any number regarding this performance difference?
As far as I know libpcap has leveraged af_packet in Linux. I thought they should have similar performance before.
pcap, which uses the libpcap library and works on most platforms, but it’s not the fastest option.
af__packet, which uses memory mapped sniffing. This option is faster than libpcap and doesn’t require a kernel module, but it’s Linux-specific