Abstract: An embodiment may involve receiving a chunk and a chunk index, where the chunk contains packets captured by a network interface unit and the chunk index contains timestamps of first and last packets within the chunk. The chunk may be stored in a first ring buffer of a first memory and the chunk index may be stored in an index buffer of the first memory. A first processor may allocate an entry in an I/O queue of a second memory and an entry in a chunk processing queue of the first memory. The first processor may read the chunk processing queue to identify and copy the chunk from the first ring buffer to a location in a second ring buffer of the second memory, the location associated with the entry in the I/O queue. A second processor may instruct a controller to write the chunk to a non-volatile memory unit.