Method and device for self-adaptation multi-network-card packet capturing

Abstract

The invention provides a method for self-adaptation multi-network-card packet capturing. The method includes initializing network cards and distributing sharing caches for the network cards; determining an upper limit of a free queue of each network card; obtaining quantity of network data packets of each network card and determining dynamic adjusting parameters according to the quantity of the network data packets of each network; distributing the sharing caches occupied by each network card and use rate of the free queue according to the dynamic adjusting parameters; enabling the sharing caches to read and store data packet data of each network card simultaneously; and enabling a protocol stack to read the data packet data in the sharing caches. The invention further provides a device for the self-adaptation multi-network-card packet capturing, which comprises an initializing unit, a free queue determining unit, a sharing cache monitoring unit, a first data reading unit and a second data reading unit. The method and the device for the self-adaptation multi-network-card packet capturing improve capacity of a single device for processing network data, and simultaneously a self-adaptation packet capturing mode guarantees speed of data transmission.

Description

technical field [0001] The invention relates to the field of network data transmission, in particular to an adaptive multi-network card packet capture method and device. Background technique [0002] Network data packet capture, monitoring and analysis technology is the basic technology of network security maintenance, and also the core means of network intrusion. The current network packet capture can be captured through the network card of a single device or a dedicated packet capture network adapter, but the network packet processing capability of a single device is limited by the data processing capability of the network card. Taking the Intel network card as an example, the current server Network cards are divided into 10 Gigabit, Gigabit and 100 Gigabit network cards. If you want to achieve a higher level of data capture, you need to use a dedicated packet capture network adapter to improve the system’s packet capture performance and reduce the CPU usage of the host. D...

AI Technical Summary

Problems solved by technology

The current network packet capture can be captured through the network card of a single device or a dedicated packet capture network adapter, but the network packet processing capability of a single device is limited by the data processing capability of the network card. Taking the Intel network card as an example, the current server Network cards are divided into 10 Gigabit, Gigabit and 100 Gigabit network cards. If you want to achieve a higher level of data capture, you need to use a dedicated packet capture network adapter to improve the system’s packet capture performance and reduce the CPU usage of the host. Dedicated packet capture network The adapter is theoretically feasible, but in engineering practice, considering factors such as compatibility with the server and price, it is not widely used

Therefore, there has been a multi-network card packet capture technology. The existing multi-network card packet capture technology can use multiple network cards to improve data processing capabilities, thereby improving the network data transmission capacity of a single device to the greatest extent. However, due to multiple network cards working at the same time, The data transmitted by each network card cannot be processed in time

Images