Noff: A Novel Extendible Parallel Library for High-Performance Network Traffic Monitoring

Yanchao Jing,Guangtao Xue,Shiyou Qian

DOI: https://doi.org/10.1109/APSEC.2017.19

2017-01-01

Abstract:Nowadays, an in-depth understanding of the Internet traffic profile is indispensable. Many network monitoring applications claim the connection-oriented analysis. However, many existing capture tools are too low-performance to cope with the large network traffic flow. Though some tools using traffic sampling can handle heavy network stream, there is information loss. While some parallel methods have been adopted to optimize the performance, there are insufficient extendible easy-use libraries. To feed this demand, this paper proposes a flexible parallel network library (Noff) which has the ability to process the network traffic at speed up to 6 Gbps. Noff supports two kinds of parallel processing procedures on the multi-core architecture to improve system compatibility and performance. Furthermore, Noff proposes a timing wheel scheme to process some network abnormity. For extendibility, Noff also offers many flexible callback interfaces. Some well-designed experimental evaluations indicate that Noff can perform about 25% better than other software libraries in terms of streams processing and can perform much better using a multi-core platform. Under the same circumstance, Noff can also process much higher concurrent traffic. Noff is currently deployed in a campus access point to process traffic at 500-800Mbps speed to offer stream information for a network security monitoring platform.