The Research Of High-Performance Packet Capture Platform Based On Intel Gigabit Network Card In Linux Environment

Many network monitoring systems are based on wire-speed packet capture and real-time analysis. Such as, intrusion detection systems, protocol analysis, network firewall, high-performance communications systems, high-performance router, host routers and other network monitoring systems.At present, most of the intrusion detection system, firewall, and so on are based on PC architecture running on the Linux platform.In fast network environment, the common interface card and Libpcap is enough to guarantee that the user space application, on the linux system, can wire-speed capture network packets.such as: tcpdump, ethereal and snort, and so on. As the time of the gigabit network, it is impossible for general operating system to capture packet or send packet at wire speed. This paper designs a high-performance zero-copy platform, it decreases the number of the copy and the buffer between kernel and user space, reduces the overhead of the system call, thus the network packet processing performance is greatly improving.Main tasks:1. Analysed the Linux network protocol stack, analyzed the traditional packet capture platform Libpcap.2. Analysed the Intel Gigabit Ethernet driver deeply, the interrupt mechanism, the soft interrupt mechanism and the memory mapping mechanism.3. We implemented a new high-performance network packet capture platform ZeroP based on Intel-based Gigabit Ethernet in the Linux 2.6 kernel. The ZeroP platform contains two components: a device driver module in kernel-space and a user-space library compatible with Libpcap.4. Built CISCO test platform, tested the performance and the compatibility, analysed the test data.