一种高效网络数据捕包平台的设计与实现  

A High Performance User Level Packet Capture System

作　　者：张志斌[1] 郭莉[1] 陈明宇[1] 方滨兴[1] 

机构地区：[1]中国科学院计算技术研究所

出　　处：《计算机工程》2005年第20期212-213,共2页Computer Engineering

摘　　要：提出了一种基于用户空间的捕包平台设计――ULPF(User Level Packet Filter)。系统完全在用户空间实现;通过修改网卡驱动将数据绕过操作系统内核直接提交给用户空间避免了耗时的数据拷贝操作;利用网络数据包长度的局部性实现了一个高效的内存分配算法避免了多线程带来的内存分配开销。实验证明,该平台基本可以实现将网络数据流线速还原到TCP层。This paper designs a packet capture system ULPF（User Level Packet Filter）, which is completely implemented in user level. With optimizing network driver, people bypass kernel and put packets to user level directly so that they can avoid data copying which is time consuming. Advantage of the locality of packets length is taken to design an efficient memory allocator instead of malloc which will show its inefficiency in multithread environment. The test result indicates that this system can process TCP packets almost at line speed.

关 键 词：捕包 网络协议栈 内核 内存分配 

分 类 号：TP393.02[自动化与计算机技术—计算机应用技术]