Aiming at the performance of packet capture, this paper realizes a new protocol family dedicated to packet capture called PF_ZEROCOPY. Based on Zero-Copy and memory sharing, PF_ZEROCOPY transfers the packet from network card to the memory that user program can access directly by DMA, so that bypasses network protocols, and reduces the times of data copy. By using the descriptor ring of DMA buffer, network card and user program can work without collision to access the shared memory. PF_ZEROCOPY is easy to use and transplant by packaged into protocol family. Experimental results indicate that the throughput of PF_ZEROCOPY for random size messages is above 900Mb/s, and PF_ZEROCOPY surpasses libpcap's in performance.