两种数据包捕获架构的分析与比较

A COMPARISON BETWEEN TWO PACKET CAPTURE ARCHITECTURES

BPF与NPF是分别工作在Unix和Windows操作系统中的目前最为流行的数据包捕获架构,它们可用来生成各种网络分析及管理软件。本文介绍了包捕获架构的工作原理,分析了两者在结构和功能上的相似及不同之处,指出了各自在捕获性能上的优缺点。

BPF and NPF are two kinds of packet capture architecture in Unix or Windows, being in most common use. They can be used to design various network analyses and softwares for use in management. This paper presents the principle and the component parts of the packet capture. A comparison about the similarity and also the difference in architecture and function between the two architectures is made. Also the advantages and shortages of each architecture are analysed.