基于Intel千兆网卡的高速包捕获技术的研究与实现  

Reseach and Implementation of High-Speed Packet Capture Technology Based on Intel Gigabit Network Card

作　　者：孙江[1] 兰巨龙[1] 

机构地区：[1]信息工程大学国家数字交换系统工程技术研究中心,河南郑州450002

出　　处：《信息工程大学学报》2011年第2期238-245,共8页Journal of Information Engineering University

基　　金：国家863计划资助项目(2009AA01A246;2008AA01Z214)

摘　　要：针对传统数据包捕获方法的技术瓶颈,结合零拷贝思想,实现了一种基于Intel千兆网卡具有较高性能的数据包捕获平台。通过对libpcap及其改进版本libpcap-mmap的实现机制的分析,找出影响其捕获性能的技术缺陷。结合零拷贝技术,在解决了内存映射和同步访问等问题的基础上,避免了报文在传输过程中的多次拷贝,实现了用户程序与网卡接口设备的直接交互;充分利用Linux所支持的NAPI技术,减少内核中断响应,解决中断湮没问题。以上两点大大提高了报文捕获性能,减轻了CPU的负担,同时降低了用户级PC成为高性能报文处理系统的技术门槛。Aiming at the technology bottlenecks of traditional data capturing methods,combined with zero-copy idea,a high performance packet capture platform, based on Intel Gigabit Ethernet,is implemented in this paper.Through the analysis of implementation mechanism of libpcap and its improved version libpcap-mmap,the technical defects,which impacts the capture performance,is identified.With zero-copy technology,after solving the problems of memory mapping and synchronization,multiple copies of packets through the transmission process are avoided,and the direct interaction between the user program and the network interface device is achieved;NAPI technology supported by Linux is used to reduce the kernel interrupt response and address the problem of interruption annihilation.The above two points greatly improve the performance of packet capture,lighten the burden on CPU,while reducing technology threshold of the user-level PC to become high-performance packet processing system.

关 键 词：LIBPCAP 零拷贝 NAPI 千兆网卡 包捕获 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]