An Efficient Packet Capture Method For High Speed Network And It's Implementation

With the rapid development of network technologies, networks are becoming more and more complicated as the scales of networks are expanding. New applications are emerging and the heterogeneity of networks is deepening. It is necessary to monitor traffic in real time and manage networks on-line. Through network traffic measurement, we can obtain the details of the traffic, such as link utilization, the distribution of the different protocols, the distribution of packet size, and so on. It is helpful for the maintenance and management of networks and facilitates the design of networks.There are many challenges in high-speed network traffic monitoring. One of the most important bottlenecks is packet capturing. Because of hardware capability and operating system overhead limitations, the existing network traffic monitoring tools based on software can only work at low speed network with the link rate below 100Mbps. This thesis mainly focuses on the key issue to perform packet capture for high-speed network with SMP machine. To achieve this point, a novel algorithm named tagged-cell algorithm has been proposed to monitor full duplex Gigabits links. We also developed a new traffic capture method based on shared memory mechanism to improve the efficiency of the packet capture. Both the algorithm and the method have been successfully implemented in the CNGI network traffic monitoring system.The main works of this thesis are described as following.(1) Proposed and implemented an efficient packet capture method with SMP machine. Combined with the tagged-cell algorithm, we can fully explore SMP machine's parallel execution capability to perform concurrency traffic capture with double GE NIC. By the use of the cell's tag to identify the status of the packet buffer, the synchronization with n-producers/1-consumer problem is simplified. The new proposed algorithm also reserved the advantages of the present algorithm, such as making use of the two small critical sections instead a large one to improve SMP machine's parallel execution capability.(2) After analyzing network traffic monitoring technique and the packet travel mechanism under Linux system, take the advantage of NAPI, we proposed an efficient packet capture method for high speed network based on shared memory.(3) Finally, we implement an efficient packet capture platform with SMP platform. The platform contain with these two features. First, make full use of SMP machine's parallel execution to achieve traffic capture with double NIC; Second, take the advantage of share memory, packet receive path from NIC driver buffer to user level application has been shorten. The results of the experiment showed that the platform we developed is more efficient than Libpcap and kernel module based method. The performance of packet capture with the platform has been improved significantly and can capture/process nearly all packets at line speed under Gigabit network.