Linux系统中基于PF_RING套接字的高性能包捕获技术

The high performance packet capture based on the PF_RING socket in Linux

介绍一种新型的数据包捕获方式——基于PF_RING套接字的数据包捕获技术.旨在提高高速复杂网络传输环境中的数据包捕获率.使用环形缓冲区,用来实现内核空间和用户空间的内存共享,用户空间可以直接对其进行读写操作,而且可以对该缓冲区的大小进行调整配置.经过实验,在100 M甚至Gbit网络环境中,结合设备轮询机制,在普通的PC机上便可以显示出其突出的数据包捕效率.

Many network monitoring tools are based on packet capture,but the performance of these popular tools is not satisfactory. Herein,a new method based on PF _ RING Socket was used to improve the performance of the packet capture under the heavy computer traffics. The ring buffer in the kernel can be accessed and configured freely by the applications of the user space.The experimental result shows that,combined with the dev _ polling, the PF _ RING socket can improve the performance of the packet capture significantly, even in the 100M or the Gbit network.