# ntop/PF_RING

High-speed packet processing framework

Repository: https://github.com/ntop/PF_RING
Canonical: https://ross.abutalabs.com/products/pf_ring
Homepage: http://www.ntop.org
Language: C
License: LGPL-2.1
License Family: copyleft
Topics: pf-ring, capture-packets, high-speed, 100gbit, 10gbit, 40gbit
Last push: 2026-08-26T08:59:49+00:00

## Health v2 (maintenance only)
Score: 73/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 25, longevity 100
- inputs: {"age_days": 4139, "days_push": 7, "days_rel": 289, "gap_med": 203, "n_releases_24m": 2}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2965, forks 363 (observed 2026-08-28T04:07:32.505547+00:00)

## What it is
PF_RING is a Linux kernel module and user-space framework for high-speed packet capture and processing, offering a consistent API for network applications. It enables capturing millions of packets per second per core efficiently, from embedded ARM devices to 100Gbit servers.

## Use cases
- capture packets at 10/40/100 Gbit line rate
- build custom network monitoring or IDS tools
- process millions of packets per second per core
- reduce CPU usage for packet capture applications
- analyze traffic on ARM embedded devices
- feed packet data to ntopng, nProbe, or Suricata

## When to choose
- you need line-rate packet capture on Linux beyond what libpcap handles
- you are building network monitoring, IDS, or traffic analysis applications
- you want a consistent packet processing API across hardware platforms

## When to avoid
- you only need low-rate capture where libpcap suffices
- you are not on Linux, as PF_RING is Linux kernel-specific
- you need a portable cross-platform networking library

## Facets
- artifact type: framework
- maturity: stable
- function: networking, monitoring, developer-tools
- domain: networking, security, monitoring, developer-tools
- platform: c
- tags: packet-capture, high-speed-packet-processing, kernel-module, network-monitoring, ids, traffic-analysis, linux

## Member repositories
- ntop/PF_RING (main) score 73

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:32.505547+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:32:03.825614+00:00, confidence not recorded.
  - readme: https://github.com/ntop/PF_RING (fetched 2026-08-28T04:07:32.505547+00:00, sha 1d4f04cf0bfb)
  - homepage: http://www.ntop.org (fetched 2026-08-29T09:47:26.892579+00:00, sha da40264de79d)
  - site_page: https://www.ntop.org/support/documentation/brochures (fetched 2026-08-29T09:47:26.947500+00:00, sha f13f68b2c2d2)
  - site_page: https://www.ntop.org/about-us/the-company (fetched 2026-08-29T09:47:26.955569+00:00, sha 8e5d15a7c66f)
  - site_page: https://www.ntop.org/support/documentation/users-guides (fetched 2026-08-29T09:47:26.942351+00:00, sha 35f046d18d07)
  - site_page: https://www.ntop.org/support/documentation/software-installation (fetched 2026-08-29T09:47:26.920672+00:00, sha 7d1b7c3958ce)
  - site_page: https://www.ntop.org/about-us/meet-the-ntop-team (fetched 2026-08-29T09:47:26.958307+00:00, sha 9c6286c5a7e6)
  - site_page: https://www.ntop.org/about-us/partners-and-resellers (fetched 2026-08-29T09:47:26.960332+00:00, sha 4b4d7eb1a64a)
  - site_page: https://www.ntop.org/about-us/resellers (fetched 2026-08-29T09:47:26.962419+00:00, sha 81287bba2c4c)
  - site_page: https://www.ntop.org/support/need-help/faq (fetched 2026-08-29T09:47:26.950439+00:00, sha 522b8efa44e7)
- Data as of 2026-08-30T08:39:29.467469+00:00.