A Comparative Study of Packet Capture Tools for Reliable Network Telescope Traffic Collection

Reliable packet capture is a critical first stage in the data collection pipeline of passive monitoring environments such as network telescopes, forming the foundation for subsequent network forensic investigations and large-scale traffic analytics. This study compares five widely used packet capture tools: libpcap, tcpdump, xdpdump, netsniff-ng, and dpdk, in the context of Merit Network's /13 telescope infrastructure. The evaluation focuses on throughput, packet loss, system resource usage, and capture stability. To support this analysis, we developed an automation script that manages capture rotation, tracks system statistics, and performs health checks on resulting pcap files. Experimental results highlight the tradeoffs between lightweight, general-purpose tools and specialized frameworks optimized for high-performance environments. The findings provide practical guidance for selecting and deploying packet capture solutions that balance reliability, efficiency, and operational simplicity in long-running telescope deployments.