Linux下的高流量数据包监听技术  

Monitor technique with high flow of data packets in Linux

作　　者：马博[1,2] 袁丁[1] 

机构地区：[1]四川师范大学计算机科学学院,成都610061 [2]天融信网络安全技术有限公司成都研发部,成都610063

出　　处：《计算机应用》2009年第5期1244-1247,1250,共5页journal of Computer Applications

基　　金：四川省计算机软件重点实验室重点项目

摘　　要：研究了Linux操作系统中使用底层抓包函数库Libpcap处理高量数据包监听的原理,利用网卡设备在网络的旁路处进行数据捕捉后预处理,利用NAPI技术实现设备半轮询机制以加快数据在缓冲区的处理速度,最后利用排队论原理计算最优带宽值并设置相关参数以达到最佳处理效率。实验表明,该方法不仅提高数据包的捕捉率,并且在系统资源占用率等多项指标中都有显著改善。The principle of packet monitor to handle high volume packets using the underlying library Libpcap capture in Linux operation system was studied. Network Interface Card （NIC） was used to capture data in bypass monitor to carry out pre-processing. Semi-polling with New API （NAPI） was also used to speed up the processing of packets in input buffer. Finally the queuing theory was used to ensure the optimal bandwidth value and relevant parameters were set to achieve the best efficiency. Experimental results demonstrate that the scheme not only increases the rate of packet capture, but also improves the occupancy rate of system resources in many figures significantly.

关 键 词：网络监听 LIBPCAP TCP协议 多线程 半轮询 New API 

分 类 号：TP393.03[自动化与计算机技术—计算机应用技术]