Pf_ring is a project mainly written in C and SHELL, it's free.
PF_RING SVN mirror (code is GPLv3, btw)
This directory contains:
kernel/ Kernel related patches userland/ User space code userland/lib/ User space library used to manpulate PF_RING userland/libpcap-XXX-ring/ Libpcap enhanced with PF_RING support userland/examples/ P(acket)count application (use it for your tests)
See also:
PF_RING and Snort http://synfulpacket.blogspot.com/2006/11/pfring-and-snort.html See the new daq library
Advanced Packet Capturing Howto: PF_RING, NAPI and extended libpcap on Debian Sarge http://bjou.homeunix.net/blog/2006/12/advanced-packet-capturing-howto-pf_ring-napi-and-extended-libpcap-on-debian-sarge/
NOTE As of PF_RING 4.x you NO LONGER NEED to patch the linux kernel. If you are using a patched kernel, please revert the patch otherwise you will capture the same packet twice
(C) Luca Deri 2004-10