Comment by mlacitation

The design document is a good read and includes high-level details of how they're grabbing packets (AF_PACKET), the packet index format (leveldb), and defensive action they took (fuzz testing via AFL, setcap, setcomp):

https://github.com/google/stenographer/blob/master/DESIGN.md