A method for monitoring communication on a network. The method includes configuring a classifier using a monitoring rule, receiving a plurality of packets from the network; analyzing each of the plurality of packets by the classifier to determine to which of the plurality of packets satisfies the monitoring rule; forwarding any of the plurality of packets that satisfy the monitoring rule to a first hardware receive ring (HRR) located on a first physical network interface (NI), forwarding any of the plurality of packets that do not satisfy the monitoring rule to a second HRR, and transmitting a first number of packets from the first HRR directly to user level memory, wherein the user level memory resides on a host operatively connected to the first physical NI.