Abstract: In the network analysis and tracking, network security emergency response needs a emsrgency sensor that captures saw packets of specific IP, port, protocol. Base on the high-speed packet capture tool PF_RING DNA, it uses mutil-thread to capture network packets that match sensor rules, and allocates the shared buffer to improve the performance of the disk storage of packets, at the same time through setting different states for the packet sensor rule, impliments adding sensor rules and human intervention dynamically. The experimental results show that in the dual 10 Gigabit NICs environment, emergency sensor can capture and handle network traffic of 19.98 Gbit/s(3.5 Mpacket/s), and the maximum rate of emergency sensor is 1 297 Mbit/s(204.9 kpacket/s).