What is this? #

XDPethmon is an XDP accelerated Ethernet and VLAN monitor for Linux.

Features #

• XDP accelerated packet capture with speeds up to 100GbE
• A source MAC address overview with packet counts and vendor/OUI information
• An Ethertype/VLAN statistic up to a nesting level of 4 (802.1q/0x8100 and QinQ 802.1ad/0x88a8)
• Selective recording to PCAP files for further analysis with other common tools like Wireshark

What is AF_XDP? #

AF_XDP is a raw socket optimized for high performance packet processing and allows zero-copy between kernel and applications. As the socket can be used for both receiving and transmitting, it supports high performance network applications purely in user space.

Further Information and Links #

• https://www.kernel.org/doc/html/latest/networking/af_xdp.html
• https://en.wikipedia.org/wiki/Express_Data_Path
• https://ebpf-docs.dylanreimerink.nl/linux/concepts/af_xdp/

Availability #

XDPethmon is (soon) available at no cost with a trial license for a unspecified period of time (there is no need and also no possibility to purchase a registered license).

Supported Linux distributions:

• RHEL 9
• Alma 9
• Rocky 9
• CentOS Stream 9
• Debian 12
• Ubuntu 24 LTS