Linux系统中基于PF_RING套接字的高性能包捕获技术  

The high performance packet capture based on the PF_RING socket in Linux

作　　者：顾瑞春[1] 谭跃生[1] 贾元春[1] 王静宇[1] 

机构地区：[1]内蒙古科技大学网络中心,内蒙古包头014010

出　　处：《内蒙古科技大学学报》2007年第2期152-156,共5页Journal of Inner Mongolia University of Science and Technology

基　　金：内蒙古高校科研基金资助项目(NJ04021)

摘　　要：介绍一种新型的数据包捕获方式——基于PF_RING套接字的数据包捕获技术.旨在提高高速复杂网络传输环境中的数据包捕获率.使用环形缓冲区,用来实现内核空间和用户空间的内存共享,用户空间可以直接对其进行读写操作,而且可以对该缓冲区的大小进行调整配置.经过实验,在100 M甚至Gbit网络环境中,结合设备轮询机制,在普通的PC机上便可以显示出其突出的数据包捕效率.Many network monitoring tools are based on packet capture,but the performance of these popular tools is not satisfactory. Herein,a new method based on PF _ RING Socket was used to improve the performance of the packet capture under the heavy computer traffics. The ring buffer in the kernel can be accessed and configured freely by the applications of the user space.The experimental result shows that,combined with the dev _ polling, the PF _ RING socket can improve the performance of the packet capture significantly, even in the 100M or the Gbit network.

关 键 词：数据包捕获 设备轮询 环形缓冲区 PF_RING套接字 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]