Performance Evaluation of Python Tools to Capture Packets in Resource-Constrained Devices - Silva, Otávio O.; Batista, Daniel M. (Anais do Workshop em Desempenho de Sistemas Computacionais e de Comunicação (WPerformance); 2025: Anais do XXIV Workshop em Desempenho de Sistemas Computacionais e de ComunicaçãoDO - 10.5753/wperformance.2025.8983, 2025)
Real-time traffic classifiers, such as Intrusion Detection Systems based on Online Learning, must be constantly fed with packets to classify the traffic by a specific deadline. When considering Python, there are several options for capturing packets. This paper evaluates the performance of three tools to capture packets in Python running on a Raspberry Pi 3 Model B. Exhaustive experiments conclude that Pypcap + dpkt is the best option over Pyshark and Scapy. For instance, in terms of average CPU usage, when capturing TCP traffic over cable, Pypcap + dpkt consumed 75.73% less than Pyshark and 4.24% less than Scapy. All the code used to run the experiments is shared as free and open-source software for reproducibility.