title: Capturing performance with pcap vs raw socket
body: <p>When capturing network traffic for debugging, there seem to be two common approaches:</p>
  
  <ol>
  <li><p>Use a raw socket.</p></li>
  <li><p>Use libpcap.</p></li>
  </ol>
  
  <p>Performance-wise, is there much difference between these two approaches? libpcap seems a nice compatible way to listen to a real network connection or to replay some canned data, but does that feature set come with a performance hit?</p>