FYI compiling a libpcap with PF_RING and having to recompile everything that depends on it can be a real bear if you're trying to do it via the operating system

FYI compiling a libpcap with PF_RING and having to recompile everything that depends on it can be a real bear if you're trying to do it via the operating system's package manager (tcpdump, wireshark, etc), but it is totally worth it. PF_RING will let you do wire rate pcaps with 0 dropped packets.