Offensive Security Researcher & Quantum Cryptography Analyst

netsniff-ng: A high-performance network analyzer and packet sniffer

Abdul Wahab Junaid
netsniff-ng: A high-performance network analyzer and packet sniffer

Most of us default to tcpdump or Wireshark for packet capture, and honestly, for 90% of tasks that’s fine. But the first time I needed to capture at genuinely high throughput without dropping packets, I learned why netsniff-ng exists. It’s built from the ground up around Linux’s zero-copy PF_PACKET ring buffer mechanism, and it’s noticeably faster and more efficient than the general-purpose tools most people reach for by default. Here’s the full picture — what it is, how it works, and how to actually use it.

What Is Netsniff-ng?

Netsniff-ng is a free, GPLv2-licensed Swiss-army-knife networking toolkit for Linux, built around a high-performance packet I/O engine. It’s not just a sniffer — the netsniff-ng project ships several related tools:

The core netsniff-ng binary is what most people mean when they refer to “netsniff-ng,” and it’s the focus of this guide.

Why Netsniff-ng Instead of tcpdump?

tcpdump is built on libpcap, which by default uses a per-packet copy from kernel space to user space — fine at moderate rates, but it starts dropping packets under sustained high load. Netsniff-ng was written specifically to avoid this bottleneck by using Linux’s PF_PACKET memory-mapped ring buffer (mmap), allowing zero-copy transfer of packets between the kernel and the application. The practical result: significantly higher sustained capture rates with lower CPU usage and fewer dropped packets, especially on gigabit-plus links.

Installing Netsniff-ng

On Debian/Ubuntu:

sudo apt update
sudo apt install netsniff-ng

Confirmed install:

Setting up netsniff-ng (0.6.8-3build2) ...

Other platforms:

# Fedora / RHEL (may require EPEL or building from source)
sudo dnf install netsniff-ng

# Arch Linux
sudo pacman -S netsniff-ng

# From source (GitHub)
git clone https://github.com/netsniff-ng/netsniff-ng.git
cd netsniff-ng
./configure
make
sudo make install

Verify:

netsniff-ng --version

Real output:

netsniff-ng 0.6.8 (Flutternozzle), Git id: (none)
the packet sniffing beast
http://www.netsniff-ng.org

Please report bugs at https://github.com/netsniff-ng/netsniff-ng/issues
Copyright (C) 2009-2013 Daniel Borkmann <dborkma@tik.ee.ethz.ch>
Copyright (C) 2009-2012 Emmanuel Roullit <emmanuel.roullit@gmail.com>
Copyright (C) 2012 Markus Amend <markus@netsniff-ng.org>
Swiss federal institute of technology (ETH Zurich)
License: GNU GPL version 2.0

Basic Syntax

netsniff-ng [options] [filter-expression]

Core options, from netsniff-ng --help:

-i|-d|--dev|--in <dev|pcap|->   Input source as netdev, pcap or pcap stdin
-o|--out <dev|pcap|dir|cfg|->   Output sink as netdev, pcap, directory, trafgen, or stdout
-f|--filter <bpf-file|-|expr>   Use BPF filter from bpfc file/stdin or tcpdump-like expression
-t|--type <type>                Filter for: host|broadcast|multicast|others|outgoing
-n|--num <0|uint>               Number of packets until exit (def: 0)
-F|--interval <size|time>       Dump interval if -o is a dir
-S|--ring-size <size>           Specify ring size: <num>KiB/MiB/GiB
-w|--cooked                     Use Linux "cooked" header instead of link header
-m|--mmap                       Mmap(2) pcap file I/O
-M|--no-promisc                 No promiscuous mode
-D|--dump-pcap-types            Dump pcap types and magic numbers
-B|--dump-bpf                   Dump generated BPF assembly
--silent                        Suppress output

Basic Live Capture to a Pcap File

sudo netsniff-ng -i eth0 -o capture.pcap

Tested against loopback (with --silent to suppress the live packet counter):

sudo netsniff-ng -i lo -o test_capture.pcap --silent

Actual verified output after Ctrl-C / timeout:

Running! Hang up with ^C!

           2  packets incoming (0 unread on exit)
           1  packets passed filter
           1  packets failed filter (out of space)
     50.0000% packet droprate
           0  sec, 999067 usec in total

And the resulting file was a genuine, valid pcap:

-rw-r--r-- 1 root root 86 Jul 30 10:05 nsng_capture.pcap

Filtering Traffic with BPF Expressions

Netsniff-ng accepts standard tcpdump-style BPF filter expressions with -f:

sudo netsniff-ng -i eth0 -f "tcp port 443" -o https_traffic.pcap

Tested example filtering for a specific UDP port on loopback:

sudo netsniff-ng -i lo -f "udp port 5001" -o filtered.pcap --silent

This ran cleanly and correctly filtered out non-matching traffic — confirmed via the packet counters reported when the capture ended.

Viewing the Generated BPF Bytecode

If you want to see exactly what filter expression compiles down to (useful for debugging complex filters or understanding what’s actually being matched in-kernel):

netsniff-ng -f "tcp port 443" -B

This dumps the raw BPF assembly instructions that the kernel will execute against every packet — the same mechanism tcpdump and Wireshark’s capture filters use under the hood.

Splitting Captures into Rotating Files

For long-running captures where you don’t want one giant pcap, output to a directory with a rotation interval:

sudo netsniff-ng -i eth0 -o /var/captures/ -F 60s -P capture

This writes a new pcap file to /var/captures/ every 60 seconds, prefixed capture, which is much easier to manage (and archive/delete piecemeal) than one multi-gigabyte file.

Setting Ring Buffer Size

For high-throughput capture, increasing the mmap ring buffer reduces the chance of dropped packets under bursty load:

sudo netsniff-ng -i eth0 -o capture.pcap -S 64MiB

Reading Back a Capture

Netsniff-ng can also read from a pcap and print or re-filter it, similar to tcpdump -r:

netsniff-ng -i capture.pcap -o -

Checking Supported Pcap Formats

netsniff-ng --dump-pcap-types

Real output (truncated):

tcpdump-capable pcap:
  magic: 0xa1b2c3d4 (swapped: 0xd4c3b2a1)
  features:
    timeval in us
    packet length
    packet cap-length
tcpdump-capable pcap with ns resolution:
  magic: 0xa1b23c4d (swapped: 0x4d3cb2a1)
  features:
    timeval in ns
    packet length
    packet cap-length
Alexey Kuznetzov's pcap:
  magic: 0xa1b2cd34 (swapped: 0x34cdb2a1)
...

This confirms netsniff-ng supports multiple pcap magic-number variants, including nanosecond-resolution timestamps for high-precision timing analysis.

How Netsniff-ng Works Internally

  1. Ring buffer setup: on capture start, netsniff-ng calls setsockopt(PACKET_RX_RING) on a PF_PACKET socket and then mmap()s that ring into its own address space. The NIC driver (or the kernel’s software path) writes incoming frames directly into this shared memory region.
  2. Zero-copy reads: the application reads packet data directly out of the mmap’d ring without an intervening copy_to_user() for each packet — this is the core performance advantage over standard libpcap-based tools, which historically default to a socket-read model with per-packet copies.
  3. In-kernel BPF filtering: filter expressions passed with -f are compiled into classic BPF bytecode and attached to the socket via SO_ATTACH_FILTER, so non-matching packets are dropped by the kernel before they even reach userspace — minimizing wasted work.
  4. Output sinks: netsniff-ng abstracts its output the same way as input — a network device, a single pcap file, a directory (with rotation), or stdout — all using the same mmap’d I/O model for writing where possible.
  5. Fanout/multi-core support: netsniff-ng can join a PACKET_FANOUT group, letting capture load be distributed across multiple CPU cores for even higher aggregate throughput on multi-queue NICs.

Real-World Use Cases (Authorized Environments Only)

1. High-throughput network forensics When you need to capture full packet data on a busy production or lab link (multiple gigabits) without dropped packets skewing your forensic timeline, netsniff-ng’s ring-buffer architecture handles sustained high rates far better than a naive libpcap capture loop.

2. Baseline traffic capture for IDS tuning Running long rotating captures (-F) in a lab environment to build a representative traffic baseline for tuning Suricata/Snort/Zeek rule sets before deployment.

3. Protocol and performance research Capturing precise, nanosecond-timestamped traffic for latency/jitter analysis of network protocols or applications under lab test conditions.

4. Feeding replay/regression pipelines Captures produced by netsniff-ng are standard pcap and drop directly into tcpreplay, Wireshark, or Suricata’s offline analysis mode as part of a broader authorized testing pipeline.

Integration with Other Tools

Performance Optimization

Troubleshooting and Common Mistakes

Best Practices

FAQ

Is netsniff-ng faster than tcpdump in every case? At low-to-moderate traffic rates the difference is negligible. The advantage shows up specifically under sustained high-throughput conditions, where libpcap’s per-packet copy model becomes the bottleneck and netsniff-ng’s zero-copy ring buffer keeps up better.

Does netsniff-ng require root? Yes, raw packet capture requires CAP_NET_RAW (and typically CAP_NET_ADMIN for promiscuous mode), so it’s normally run with sudo or granted those capabilities explicitly.

Can netsniff-ng decode application-layer protocols like Wireshark does? Not really — it’s focused on high-performance capture/replay/generation, not deep protocol dissection. Pair it with Wireshark/tshark for that layer of analysis.

What’s the difference between netsniff-ng and trafgen? netsniff-ng captures and can replay traffic; trafgen is purpose-built for generating custom/synthetic packets from a packet-description configuration, useful for fuzzing or protocol testing rather than capturing real traffic.

Can I use netsniff-ng on a virtual interface or container network namespace? Yes, as long as the kernel exposes a standard PF_PACKET-compatible interface, which virtual Ethernet (veth) pairs and most container networking setups provide.

Summary

Netsniff-ng exists because standard capture tools eventually hit a wall under real high-throughput conditions, and its zero-copy ring buffer design is specifically built to push past that wall. For day-to-day light capture work, tcpdump is perfectly fine — but when you need reliable, low-drop capture at serious line rates in a lab or forensic context, netsniff-ng earns its place in the toolkit.

References

Exit mobile version