Performance Evaluation of Python Tools to Capture Packets in Resource-Constrained Devices

Real-time traffic classifiers, such as Intrusion Detection Systems based on Online Learning, must be constantly fed with packets to classify the traffic by a specific deadline. When considering Python, there are several options for capturing packets. This paper evaluates the performance of three tools to capture packets in Python running on a Raspberry Pi 3 Model B. Exhaustive experiments conclude that Pypcap + dpkt is the best option over Pyshark and Scapy. For instance, in terms of average CPU usage, when capturing TCP traffic over cable, Pypcap + dpkt consumed 75.73% less than Pyshark and 4.24% less than Scapy. All the code used to run the experiments is shared as free and open-source software for reproducibility.