libpcap README document:
Although most packet capture interfaces
support in-kernel filtering,
libpcap utilizes in-kernel filtering only for the BPF interface.
On systems that don't have BPF, all packets are read into user-space
and the BPF filters are evaluated in the libpcap library, incurring
added overhead (especially, for selective filters).

libpcap capture packet in kernel or user in linux? other, anybody can
get me some data for BPF or LSF/thks.