On 9/29/22 7:56 AM, Henning Fehrmann wrote: > Is there any chance to improve the ringbuffer output? > Or could I get the packets onto disks in any other way using bpf helper > functions? Do I need to gather more or other information? you can't do any packet copies in the datapath, and right now there is no other option - perf buffers and bpf ringbuffer both require copies. To maintain data rate you need a second server and span the port at the switch.