基于Netmap的网络监听技术研究  

The Network Monitoring Technology based on Netmap

作　　者：刘文敏[1,2] 张冬梅[1,2] 李舒辰 汪莹[3] 

机构地区：[1]北京邮电大学信息安全中心,北京100876 [2]北京邮电大学灾备技术国家工程实验室,北京100876 [3]广东电网电力调度控制中心,广东广州510600

出　　处：《信息网络安全》2013年第11期45-48,共4页Netinfo Security

基　　金：国家自然基金[61070204;61101108]

摘　　要：网络监听是网络数据采集的重要方式,Linux下通常通过调用libpcap库来实现,但libpcap在高速数据包处理时存在性能瓶颈。netmap是一个高速网络I/O架构,能够运行在通用操作系统之上,不需要专用网络设备,在千兆或万兆网卡上能够达到收发包的线速,且节省CPU、内存等计算机资源。与传统高速数据包捕获技术相比,netmap能够在保证高速数据包处理的同时,不会导致操作系统崩溃。文章将netmap和libpcap进行结合,应用于网络监听,不仅能够达到线速的包处理速度,节省计算机资源,还能够充分保障原有libpcap程序的兼容性。Network monitoring is an important way to collecting network data, which is usually be realistic by calling the libpcap library. There is a performance bottleneck on libpcap when processing at high speed. The netmap is a high-speed network I/O architecture that can run on common operating system, and it doesn＇t require special network device. It can withstand up to the maximum line speed of Gigabit or 10-Gigabit NIC card, and even more can save CPU, memory and other computer resources. The netmap will not cause the collapse of OS with an guarantee high- speed packet processing at the same time when comparing With traditional high-speed packet capture technology. This paper will combine netmap and libpcap, and using it in network monitoring. It will not only achieving the wire-speed processing speed, save computer resources, but also fully protecting the original libpcap program compatibility.

关 键 词：netmap LIBPCAP 网络监听 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]