High speed network traffic analysis with commodity multi-core systems

Abstract

Multi-core systems are the current dominant trend in computer processors. However, kernel network layers often do not fully exploit multi-core architectures. This is due to issues such as legacy code, resource competition of the RXqueues in network interfaces, as well as unnecessary memory copies between the OS layers. The result is that packet capture, the core operation in every network monitoring application, may even experience performance penalties when adapted to multi-core architectures. This work presents common pitfalls of network monitoring applications when used with multi-core systems, and presents solutions to these issues. We describe the design and implementation of a novel multi-core aware packet capture kernel module that enables monitoring applications to scale with the number of cores. We showcase that we can achieve high packet capture performance on modern commodity hardware.

High-density network flow monitoring

“…The work of Fusco and Deri [7] published in 2010 introduces a design of packet capture solution fully utilizing multicore systems. They use PF RING [8] with TNAPI drivers to avoid unnecessary buffer allocations and to utilize packet polling, which mitigates problems with too many interrupts.…”

Validated Model-Based Performance Prediction of Multi-Core Software Routers

“…PacketShader [5] utilizes the GPU to speed up packet processing. PF_RING [6] and netmap [7] focus on the utilization of DMA features in order to avoid copy operations that are normally needed to get packets to the user space.…”

“…Zerocopy packet processing aims to avoid costly copy operations between DMA accessible buffers, kernel-level buffers, and user space buffers. Prominent examples are PF_RING [6] coming from Linux and netmap [7] from FreeBSD, which was also ported to Linux in 2012. PF_RING modifies drivers in order to let the network interface directly access a ring buffer using DMA.…”

“…A load generator based on Click, which does not rely upon the Linux network stack allows traffic generation at a rate of about 4 Mpps. The pfsend packet generator from the PF_RING DNA software repository [6], uses a zero-copy technique and is capable of filling our links using 64 B frames. This pfsend packet generator was used for all measurement experiments presented in this paper to produce packets at a constant bit rate (CBR).…”

Packet Storage at Multi-gigabit Rates Using Off-the-Shelf Systems

“…To fully capture high-speed traffic, some capture engines [5], [6], [7], [8], [9] have been proposed in the literature, which apply some of the previous explained techniques over the driver and the network stack. Those capture engines make use of optimizations such as memory pre-allocation and reuse, prefetching packet data into system's caches, avoiding the system stack to exploit the parallel paths that multiple queues offer, etc.…”