Network Monitoring Framework for Multi-core Architectures

View the Project on GitHub pfq/PFQ


What is PFQ?

PFQ is a multi-language network monitoring framework designed for the Linux operating system that allows efficient packet capture, in-kernel functional processing and packet steering across sockets.

PFQ is highly optimized for multi-core architecture, as well as for network devices equipped multiple hardware queues. It works with any device driver and provides a script designed to obtain accelerated versions of drivers starting from their source codes.

The framework enables the development of high-performance networking applications with different languages (i.e. C, C++ and Haskell). In addition, a specific functional language designed for early stages of monitoring and networking applications is included: pfq-lang.

The package provides the source code of the PFQ kernel module, user-space libraries for C, C++11 and Haskell languages, pfq-lang implemented as eDSL and a set of diagnostic tools.



PFQ performance is highly dependent on the hardware in use.

Running on top of a Xeon processor equipped and the Intel 82599 10G controller, PFQ can process and steer to user-space the line speed (~14,8 Million packets per second) deploying 2 or 3 kernel threads.


The current stable release is the v3.0. The previous release was v2.1.12.

Source code

The package provides the source code of the PFQ kernel module, user-space libraries for the C, C++11 and Haskell languages and a set of diagnostic tools.

Gcc/g++ 4.7 (or higher), the Haskell platform, CMake and make are required for the compilation.


New to PFQ programming? The wiki pages can get you started quickly.


We received the Best-Paper-Award at PAM2012 in Vienna for the paper "PFQ: a Novel Engine for Multi-Gigabit Packet Capturing With Multi-Core Commodity Hardware"


The PFQ kernel module and user-space libraries are distributed under the GPL license.


Nicola Bonelli