A Study on Packet Capture Mechanisms in Real Time Network Traffic

Abstract

The evolution of packet capture technology has made substantial advances in packet capture whereby both software and hardware solutions have been designed to optimize packet capture performance. Packet capture is the process of capturing data packets across a computer network. Packet capture has become more challenging with the advent of fast speed networks. The complexity of capturing in high packet rates and high bandwidth creates the need for more sophisticated packet capture mechanism in real-time network traffic. Existing solutions are able to capture packets; however at certain rates in high speed network, packets will be lost. Thus, this paper aims to classify and compare the existing solutions and to address their inherent issues.

A Survey on Network Security-Related Data Collection Technologies

“…From the point of view of capturing network traffic, NetFlow can provide a higher level of abstraction for assembling related packets into groups, which are referred as flows [20]. Alias et al [36] combined the NetFlow protocol and device polling to design an enhanced passive packet capture scheme that can capture and analyze packets in a Gigabit network.…”

“…However, DAG cards provide only limited on-board filtering functionalities [27]. In addition, even though the packet capture rate of DAG cards has been proved to be 100 percent accurate, it is still a challenge to fully utilize it due to its higher cost and lower flexibility of hardware compared to software [36].…”

Impacto da criptografia da camada de transporte em análises de fluxos com aprendizado de máquina

“…A captura de pacotes (pcap), tradicionalmente utilizada no contexto da biblioteca libpcap, é uma das principais formas de análise passiva de redes, sendo extensivamente utilizada por administradores de rede e por sistemas de detecc ¸ão de intrusão (Intrusion Detection System) [Alias et al 2013]. A partir da captura de pacotes, é possível extrair estatísticas sobre o tráfego coletado, como o número de bytes transferidos, o número de pacotes enviados, o tempo de resposta, entre outros.…”