Capture Technology And Gigabit Ethernet-based Efficient Data Packet

The spreading speed of internet was fast in the past 15 years, and it was reported that the number of netizen increased 33 million, from 100 thousand in 1996 to 33.8 million in 2008. Now people have been accustomed to exchanging message or dealing with affairs by the carrier of internet. The applications based on internet are various, such as e-commence, chatting, e-mail, blog and so on. However, there are many security risks in the complex network environment. In order to management network environment effectively, some software such as network monitoring system, intrusion detection system, and firewall software appear.Whether various applications based on internet or network security software mentioned above, they always relay on bottom packet capturing. Network packet capturing plays an important role in the rapid development of network field. Especially, the faster speed of network leads to high frequency of NIC interrupt, low speed of packet processing and packet loss. These factors above can impact on the performance of upper system. Now many scholars research on how to capture packet efficiently.On the background of Enterprise network monitoring system, we relay on the broadcasting feature of Ethernet to capture packets. How to improving the performance of capture in high-traffic network environment is our focus. First, we introduce normal packet capturing method in Linux, and then model the process of packet capture to find out the factors which impact performance of system. According to these factors, we introduce some improved technology and choose zero-copy to implement our system. At last we build testing environment, and test the performance of the system by different length packets and different transmit speed.The implementation of efficient packet capturing system is based on a memory mapping interface, which is provided by kernel. Our main work emphases on three important parts. The first one is to modify the source code of NIC driver and put packets into pre-allocated kernel space; the second one is to design data structures which make the communication and synchronization between NIC and user processes; the last part is to provide a programming interface for application programmers. In the future, we will design a simplified protocol stack working in user space to improve the function of packet processing.