And the buffer can be configured in libpcap too (pcap_set_buffer_size).
Right. I have had packetbeat configuration itself in mind. In packetbeat config file you can configure the buffer size for af_packet only.
Regarding the additional copies, it depends on how we use it.
pcap_loop does't require additional memory copy.
packetbeat uses go-packet, which is not using pcap_loop, but pcap_next_ex. The mmap callback requires a memcpy to copy the packet it's content into some temporary buffer.
In addition the sniffer in packetbeat uses ReadPacketData, which also copies the packet once again (required to hold on e.g. unordered TCP packets). That is af_packet will copy the packet once, but using pcap will copy the packet twice (no matter if SOCK_RAW or SOCK_PACKET will be used).