基于Intel千兆网卡的高速包捕获技术的研究与实现

针对传统数据包捕获方法的技术瓶颈,结合零拷贝思想,实现了一种基于Intel千兆网卡具有较高性能的数据包捕获平台。通过对libpcap及其改进版本libpcap-mmap的实现机制的分析,找出影响其捕获性能的技术缺陷。结合零拷贝技术,在解决了内存映射和同步访问等问题的基础上,避免了报文在传输过程中的多次拷贝,实现了用户程序与网卡接口设备的直接交互;充分利用Linux所支持的NAPI技术,减少内核中断响应,解决中断湮没问题。以上两点大大提高了报文捕获性能,减轻了CPU的负担,同时降低了用户级PC成为高性能报文处理系统的技术门槛。

Reseach and Implementation of High-Speed Packet Capture Technology Based on Intel Gigabit Network Card

Aiming at the technology bottlenecks of traditional data capturing methods,combined with zero-copy idea,a high performance packet capture platform, based on Intel Gigabit Ethernet,is implemented in this paper.Through the analysis of implementation mechanism of libpcap and its improved version libpcap-mmap,the technical defects,which impacts the capture performance,is identified.With zero-copy technology,after solving the problems of memory mapping and synchronization,multiple copies of packets through the t...