The embodiment of the invention provides a method and a
system for capturing
network data. The method comprises the following steps: capturing a data packet by a network card, and buffering into a receiving first-in and first-out
queue of the network card; transmitting the data packet in the
queue to a pre-configured
circular buffer region through a PCI DMA (
peripheral component interconnect
direct memory access) controller; on the basis of a preset interrupt trigger strategy, transmitting an
interrupt request to a kernel mode drive; stopping receiving a new
interrupt request which is transmitted by the network card by the kernel mode drive according to the
interrupt request, updating descriptors of the
circular buffer region, and restoring to receive the new interrupt request transmitted by the network card; extracting the data packet when a user mode
data analysis device judges that the data packet exists in the
circular buffer region according to the current descriptor of the circular buffer region, and updating the descriptor of the circular buffer region, thus
zero copy of the overall transmission process is achieved. A
system call is not required, so that resources of a CPU (
central processing unit) are saved; the transmission efficiency of the data packet is improved.