Design and Implementation of a MySQL Traffic Sniffer for Full‑stack Access Logging

This article describes the background, functional requirements, architecture, packet‑capture implementation using libpcap, MySQL protocol parsing, result processing, and storage strategy (Kafka + ClickHouse) of a custom MySQL sniffer developed at Qunar to provide complete database access logs for auditing, performance analysis, and operations.

Database AuditingPacket Captureclickhouse

0 likes · 16 min read

Design and Implementation of a MySQL Traffic Sniffer for Full‑stack Access Logging

Refining Core Development Skills

Sep 8, 2021 · Fundamentals

How tcpdump Captures Packets Inside the Linux Kernel

This article explains the internal mechanisms of tcpdump, showing how it registers a virtual protocol in the kernel's ptype_all list to intercept packets during both receive and transmit paths, how netfilter interacts with these paths, and provides guidance for building a custom packet‑capture program.

Packet Capturelibpcapnetfilter

0 likes · 10 min read

How tcpdump Captures Packets Inside the Linux Kernel

ITPUB

Nov 17, 2020 · Fundamentals

Understanding Linux Packet Capture Engines: libpcap, PF_RING, DPDK, and XDP

This article compares four classic Linux packet‑capture engines—libpcap (and its mmap variant), PF_RING, DPDK, and XDP—explaining their data‑flow architectures, copy operations, zero‑copy techniques, and typical use‑cases such as DDoS defense and high‑speed networking.

DPDKLinuxPF_RING

0 likes · 9 min read

Understanding Linux Packet Capture Engines: libpcap, PF_RING, DPDK, and XDP

Liangxu Linux

Nov 12, 2020 · Information Security

Four Classic Linux Packet Capture Engines Compared: libpcap, PF_RING, DPDK, and XDP

This article compares four classic Linux packet‑capture engines—libpcap, libpcap‑mmap, PF_RING, DPDK, and XDP—detailing their data‑path architectures, copy‑count reductions, zero‑copy techniques, and typical use‑cases such as DDoS defense and high‑speed trading.

DPDKLinuxPacket Capture

0 likes · 9 min read

Four Classic Linux Packet Capture Engines Compared: libpcap, PF_RING, DPDK, and XDP

Ctrip Technology

Aug 19, 2016 · Big Data

HBase‑Based Packet Capture and Retrieval System for Large‑Scale Network Traffic

The article presents a method that leverages HBase to capture, store, index, and quickly retrieve massive network packets, using PF_RING and libpcap for high‑performance capture and providing APIs for time‑, IP‑, protocol‑, and port‑based packet backtracking.

Big DataHBasePF_RING

0 likes · 7 min read

HBase‑Based Packet Capture and Retrieval System for Large‑Scale Network Traffic