A high-speed network data packet capturing method based on zero duplication technology

Abstract

A capturing method for high speed network data packet based on the zero-copy technology, relating to field of network flow capacity monitoring and analysis. The method comprises a computer at least with one network card; the computer is arranged with operation system and data packet capturing program; the data packet capturing program captures the data packet via the network card. The method comprises following steps: 1) initialization of the network card, 2) initialization of the data packet capturing program, 3) starting data capture, being characterized in that: steps of the starting data capture are: a, the network card of a hardware layer passes the received data packet to the network card driven program of the core layer via DMA way; b, the data packet capturing program of a user layer obtains the data packet received by the network card driven program via mapping way. The capturing method for high speed network data packet based on zero-copy technology of this invention implements high speed network data packet capture based on the hardware platform and zero-copy technology. The invention has advantages of low system expense, high efficiency of capture and low reclaiming cost.

Description

technical field [0001] The invention relates to the field of network traffic monitoring and analysis, in particular to a method for capturing high-speed network data packets based on zero-copy technology. Background technique [0002] Traffic index is one of the important indexes in the process of network operation and maintenance. It is the basis of network planning and design, protocol design, service deployment, traffic engineering implementation, attack detection, and fault diagnosis. Network performance information, network service status, and attacks or weaknesses in the network can be obtained through monitoring and analyzing network traffic. Traffic monitoring and analysis technology is widely used in firewalls, intrusion detection and protocol decoding, and traffic monitoring systems. Packet capture is the premise and first step of traffic monitoring and analysis, which determines the performance of systems based on traffic monitoring and analysis. Usually, packet ...

AI Technical Summary

Problems solved by technology

Some use network processors instead of general-purpose hardware platforms to realize data packet capture and complete part of traffic monitoring and analysis functions, but the method of using network processors is very expensive, and the development and upgrade cycle is long, and large-scale deployment is not realistic; Some try to achieve packet capture through specialized hardware to achieve packet capture and then complete passive traffic monitoring and analysis. However, the implementation based on specialized hardware is also expensive, and the system lacks enough flexibility to keep up with today's ever-changing networks. Development status and demand for flow monitoring and analysis

Images