高速IDS中一种改进的数据包捕获方法的研究

Research on an Improved Packet Capture Method in High-speed IDS

在大的网络流量环境和中断批处理的情况下,数据包捕获的丢包率出现了急剧地上升。如何降低数据包捕获的丢包率是高速IDS研究的难点之一,针对这一问题,提出了一种改进的数据包捕获方法,它将Libpcap整合到Linux内核中,并结合了基于NAPI的自适应轮询方法和Linux的内存映射机制,减少了中断与系统调用的开销。实验证明,在数据包长度较小的情况下,所提方法可有效降低丢包率和CPU占用率,从而改善了包捕获的性能。

Network traffic in large environment and disruption of a batch of cases,the data packet capture of packet loss rate appeared to rise sharply. How to reduce the packet capture of the packet loss rate is high-speed IDS research one of the difficulties, in view of this issue, an improved method of packet capture is presented, it will Libpcap integrated into the Linux kernel and based on a combination of NAPI adaptive polling methods and Linux＇s memory-mapped mechanism to reduce the disruption and system call overhead. Experiments show that in the data packet length is relatively small, the proposed method can effectively reduce the packet loss rate and the CPU occupancy rate, thus improving the performance of the packet capture.