ntop/PF_RING

Health v2 · maintenance only

Adoption not part of the score

2970 stars · 363 forks observed · 2026-09-23

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

PF_RING is a Linux kernel module and user-space framework for high-speed packet capture and processing, offering a consistent API for network applications. It enables capturing millions of packets per second per core efficiently, from embedded ARM devices to 100Gbit servers.

Use cases

• capture packets at 10/40/100 Gbit line rate
• build custom network monitoring or IDS tools
• process millions of packets per second per core
• reduce CPU usage for packet capture applications
• analyze traffic on ARM embedded devices
• feed packet data to ntopng, nProbe, or Suricata

When to choose

• you need line-rate packet capture on Linux beyond what libpcap handles
• you are building network monitoring, IDS, or traffic analysis applications
• you want a consistent packet processing API across hardware platforms

When to avoid

• you only need low-rate capture where libpcap suffices
• you are not on Linux, as PF_RING is Linux kernel-specific
• you need a portable cross-platform networking library

Facets

framework · maturity stable

networking monitoring developer-tools networking security monitoring developer-tools c packet-capture high-speed-packet-processing kernel-module network-monitoring ids traffic-analysis linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ntop/PF_RING")