The Research And Implementation Of Packet Capture Platform Based On Real-time Linux

With the popularization of computer and the development of network, the bandwidth has increased dramatically , also the demand of network security grows rapidly. Nowadays the bandwidth has reached GMbps level ,the traditional packet cature platform can't fulfill the requirement of packet cature on high speed network. So research the packet capture technology under heavy load situation to provide a reliable front-end for route,firewall and IDS is a crucial and meaningful research subject.There are three main reasons that make tradtional packet cature platform can't fulfill the requirement of packet capture on high speed network .First ,the redundant data copy in kernel and the meaningless packet process given by protocol stack. Second,frequently interrupt handling. Third, too much of system calls and context switch. So based on this three points,this paper design following mechanism to improve the performance:using zero-copy method that makes packet go direct from NIC to user space,avoiding useless copying. Also it bypassed the protocol stack to prevent redundant processing;using mmap technology that maps the important data struct of kernel and driver into user space ,and makes driver can be controled in user space ,no longer needs the interrupt handling routine ; using real-time linux and designs mechanism based on it's feature: this paper develops a polling engine that not only provide a convenient way for process to visit the driver and hardware,but also can response and schedule according to the payload . Ultimately this design increases the throughput of system and decreases the CPU occupation.This paper based on x86 architecture to implementation a new packet capture mechanism, and also test the performance. Experiment result indicates that the throughputs of new packet platform based on research result for 64 byte and 1500 byte are 473Mbps and 947Mbps,and proves that compared with traditional platform,the new platform gets a remarkable enhancement on performance.