Its gain of performance is reached by zero-copy mechanisms for network packets (RX_RING, TX_RING),[3] so that the Linux kernel does not need to copy packets from kernel space to user space via system calls such as recvmsg().

netsniff-ng was initially created as a network sniffer with support of the Linux kernel packet-mmap interface for network packets, but later on, more tools have been added to make it a useful toolkit such as the iproute2 suite, for instance.

Through the kernel's zero-copy interface, efficient packet processing can be reached even on commodity hardware.

netsniff-ng is free software and has been released under the terms of the GNU General Public License version 2.

The toolkit currently consists of a network analyzer, packet capturer and replayer, a wire-rate traffic generator, an encrypted multiuser IP tunnel, a Berkeley Packet Filter compiler, networking statistic tools, an autonomous system trace route and more:[7] Distribution specific packages are available for all major operating system distributions such as Debian[8] or Fedora Linux.