基于Linux的高速网络数据捕获技术

Discussion of Network Data Capture Technology Based on Linux

当前,在Linux下普遍使用的传统捕获技术都是基于BPF机制,随着网络速度的不断提高,捕获效率却不断下降。本文介绍一种在高速网络下基于零拷贝思想的PF_RING捕获技术,通过减少内核空间到用户空间数据拷贝的方式,大大提高了系统性能,并详细阐述了PF_RING在Linux核心下的实现,通过实验验证了它的可行性。

Currently,traditional capture techniques in Linux are normally based on BPF mechanism,with the continuous improvement of network speed,capture efficiency is declining.This paper introduces a PF_RING capture method based on zero-copy theory in high-speed network,which greatly enhances the system performance through reducing the number of copy data from kernel space to user space;What＇s more,this paper specifically analyzes how to use it in Linux,at the end,the result of experiment shows that this scheme is feasible.