The Linux network stack is generic. It handles interfaces, routing, sockets, firewalling, packet delivery, and many other things. This is useful, but it has a cost. For the purpose of a high-traffic probe, this is a waste of CPU time.

XDP (eXpress Data Path) makes packets hop on the express train from the NIC to the userspace, avoiding the kernel network stack altogether.

The kernel stack cost

In the classical capture path, every packet first takes the normal receive path. It reaches the driver, becomes a kernel networking object, crosses the generic stack, then reaches a capture API such as AF_PACKET/libpcap.