from their site:
netmap implements a special device, /dev/netmap, which is the gateway
to switch one or more network cards to netmap mode, where the card's
datapath is disconnected from the operating system.
open("/dev/netmap") returns a file descriptor that can be used with
ioctl(fd, NIOCREG, ...) to switch an interface to netmap mode. A
subsequent mmap() exports to userspace a replica of the TX and RX
rings of the card, and the actual packet buffers. Each "shadow" ring
indicates the number of available buffers, the current read or write
index, and the address and length each buffer (buffers have fixed size
and are preallocated by the kernel).
so i should move the whole filtering stack to userland... seems like a
needless work for simple packet capture
