Abstract:With the development of Internet application and the increase of network bandwidth,security issues become increasingly serious.In addition to the spread of the virus,spams and DDoS attacks,there have been lots of strongly hidden attack methods.Network probe tools which are deployed as a bypass device at the gateway of the intranet,can collect all the traffic of the current network and analyze them.The most important module of the network probe is packet capture.In Linux network protocol stack,there are many performance bottlenecks in the procedure of packets processing which cannot meet the demand of high speed network environment.In this paper,we introduce several new packet capture engines based on zero-copy and multi-core technology.Further,we design and implement a scalable high performance packet capture framework based on Intel DPDK,which uses RSS (receiver-side scaling) to make packet capture parallelization and customize the packet processing.Additionally,this paper also discusses more effective and fair Hash function by which data packet can be deliveried to different receiving queues.In evaluation,we can see that the system can capture and process the packets in nearly line-speed and balance the load between CPU cores.

Design of network traffic capturers based on WinPcap

Data Packet Capture and Applications Based on WinPcap

Network Monitor Technology in Windows

Realization of WinPcap Using Visual Basic

A Design and Implementation of P2p Network Traffic Identification System

Universal Path Tracing for Large-Scale Sensor Networks.

Design and Implementation of Traffic-analysis-based Honeypot System

Data acquisition technology of link layer filtering under Linux environment

High-speed data capture technology based on dynamic memory pool and WinpCap

Implementation of IDS Based on WinPcap and Boyer-Moore

Design and Implementation of an Intrusion Prevention System Based on WINPCAP

Realtime Capture of High-Speed Traffic on Multi-Core Platform

An LAN-Monitor Experiment Based on Winpcap and Visual C++

The Comparison and Verification of Some Efficient Packet Capture and Processing Technologies.

Design and implementation of a high-speed network traffic measurement system

Supervision System for P2P Traffic Based on NDIS Intermediate Driver

Research of a Multi- NIC Forwarding Technology Base on NDIS IMD

Study on Tcpdump,a Network Analysis Software

Streaming Media Traffic Characteristic Measurement Module Design

High Speed Network Packet Capture Based on Linux

An IDS-Supported Architecture of Information Capture for High-Speed Networks