Network Monitoring Framework for Multi-core Architectures

View the Project on GitHub pfq/PFQ


What is PFQ?

PFQ is a multi-language network monitoring framework designed for the Linux operating system that allows efficient packet capture, in-kernel functional processing and packet steering across sockets.

PFQ is highly optimized for multi-core architecture, as well as for network devices equipped multiple hardware queues. It works with any device driver and provides a script designed to obtain accelerated versions of drivers starting from their source codes.

The framework enables the development of high-performance networking applications with different languages (i.e. C, C++ and Haskell). In addition, a specific functional language designed for early stages of monitoring and networking applications is included: PFQ/lang.

PFQ/lang is a pure functional language, inspired to Haskell, which allows to write small applications that run in kernel space, on top of network device drivers and below the network stack of the Linux Kernel. Through PFQ/lang it is possible to implement efficient bridges, port mirrors, simple firewalls, network balancers and so forth.

The package provides the source code of the PFQ kernel module, user-space libraries for C, C++11 and Haskell languages, PFQ/lang implemented as eDSL and a set of diagnostic tools.



PFQ performance is highly dependent on the hardware in use.

Running on top of a Xeon processor equipped and the Intel 82599 10G controller, PFQ can process and steer to user-space the line speed (~14,8 Million packets per second) deploying 2 or 3 kernel threads.


The current stable release is the master branch (v3.8).

A preview of the next release is the experimental branch (v4.0).

Source code

The package provides the source code of the PFQ kernel module, user-space libraries for the C, C++11 and Haskell languages and a set of diagnostic tools.

Gcc/g++ 4.7 (or higher), the Haskell platform, CMake and make are required for the compilation.


New to PFQ programming? The wiki pages can get you started quickly.


  • "PFQ: a Novel Engine for Multi-Gigabit Packet Capturing With Multi-Core Commodity Hardware" Best-Paper-Award at PAM2012
  • "A Purely Functional Approach to Packet Processing" ANCS 2014 Conference (October 2014)

  • Licenses

    The PFQ kernel module and user-space libraries are distributed under the GPL license.


    Nicola Bonelli