Making TCP dump without packets loss

Solution 1:

At your amount of traffic, I would claim that libpcap should have no trouble with dropped packets unless you have a particularly inefficient setup. If you are using tcpdump for capturing, it will report the amount of dropped packets in its final output line. If you see dropped packets, you might want to increase tcpdump's buffer size by supplying the -B option to set a value considerably higher than the default 2 MB.

Nevertheless, you might want to look at PF_RING:

Who needs PF_RING™?

Basically everyone who has to handle many packets per second. The term ‘many’ changes according to the hardware you use for traffic analysis. It can range from 80k pkt/sec on a 1,2GHz ARM to 14M pkt/sec and above on a low-end 2,5GHz Xeon. PF_RING™ not only enables you to capture packets faster, it also captures packets more efficiently preserving CPU cycles. Just to give you some figures you can see how fast nProbe, a NetFlow v5/v9 probe, can go using PF_RING™, or have a look at the tables below.

10 Gigabit tests performed on a Core2Duo 1.86 GHz and a low-end Xeon 2,5 Ghz

                                    ixgbe 
            Application                                 Rate 
pfcount (RX, with PF_RING™ DNA)        11 Mpps (Core2Duo), 14.8 Mpps (Xeon) 
pfsend (TX, with PF_RING™ DNA)         11 Mpps (Core2Duo), 14.8 Mpps (Xeon)

The PF_RING user guide explains how to compile and configure PF_RING-enabled libpcap libraries, if you insist on using libpcap applications for packet capture.