It seems like the main thing making that process fast is the fact that it's doing polling. But Linux does polling too, when there are enough packets coming in.

It seems like the main thing making that process fast is the fact that it's doing polling. But Linux does polling too, when there are enough packets coming in. Likewise, if you really are dropping packets very early in the networking stack, you wouldn't reach the TCP layer and would have a small working set in the kernel too. So, why not just implement this very fast userspace process as a kernel patch? That seems much easier...