DPDK Summit 2026

In the field of high-performance networking, traditional packet capture tools like tcpdump are facing a massive blind spot in observability. tcpdump relies heavily on the kernel protocol stack, whereas modern high-performance applications widely adopt DPDK technology. In DPDK, packets flow directly between userspace drivers and applications via mbuf, completely bypassing the kernel.

To address these pain points, we have introduced an internal open-source network observability tool — netcap.

Netcap not only inherits the ability to trace kernel skbs but also achieves breakthrough support for DPDK mbufs:
- Deep Userspace Introspection: It can delve directly into userspace memory, non-intrusively capturing and parsing mbuf data flowing through critical DPDK processing functions.
- Zero Learning Curve: It perfectly supports tcpdump filter syntax (BPF filters), allowing developers to precisely capture the mbuf traffic they care about, just like using tcpdump.

The emergence of netcap effectively fills the gap in "mbuf observability" within high-performance network development, making black-box debugging of DPDK applications a thing of the past.