基于通用PC的千兆流归并系统  

Commodity PC Based on Flow Aggregation System for Gigabit Networks

作　　者：申文超[1] 杨波[1] 吕国晗[1] 严程[1] 李星[1] 

机构地区：[1]清华大学电子工程系NGN实验室,北京100084

出　　处：《厦门大学学报（自然科学版）》2007年第A02期126-128,共3页Journal of Xiamen University：Natural Science

基　　金：国家863项目(2006AA01Z201130)资助

摘　　要：Cisco Netflow在流量监控、网络安全等许多方面得到了广泛的应用.目前高端路由器大都支持Netflow数据输出,但使用路由器来产生Netflow存在输出字段不够丰富、无法定制等弊端.本文设计并实现了一种基于通用PC和普通千兆网卡的高速数据包采集与流归并系统,实时采集千兆链路流量并输出Netflow数据.通过修改网卡驱动,实现了数据包在内存中的零拷贝.通过多索引队列实现负载均衡,系统可将一路网卡流量分配到多个CPU并行处理,有效利用了多CPU的计算资源,大大提高了系统处理能力.系统的流归并模块使用Netflowv9格式,可输出丰富的流信息.测试表明,该系统能够实现单路千兆链路环境下100万pps的数据包采集和流归并.Cisco Netflow is widely used in many areas such as traffic monitoring, network security, etc. Most of high-end routers today can export Netflow, but their fixed format lacks some valuable information and cannot be customized. This paper covers the design and implementation of a high speed flow aggregation system based on commodity PC and general-purpose network cards. By modifying the network card driver, no packet copy in the RAM is achieved. By implementing a software based traffic scheduler, traffic from one network card is assigned to several CPUs for paralld process. This improves the system performance drastically. Netflow v9 format is used. According to the performance test, the system can process traffic from a single Gigabit link with 1 000 000 pps very well.

关 键 词：CISCO NETFLOW 数据包采集 流归并 千兆链路 

分 类 号：TP393.07[自动化与计算机技术—计算机应用技术]