WireCAP: A novel packet capture engine for commodity NICs in high-speed networks

Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC

Volumn , Issue , 2014, Pages 395-406

  Wu, Wenji ^a   Demar, Phil ^a  

^a FERMI NATIONAL ACCELERATOR LABORATORY   (United States)

Author keywords

Linux kernel; Multi core system; Network packet capture

Indexed keywords

COMPUTER OPERATING SYSTEMS; DROPS; ENGINES; PACKET LOSS; SOFTWARE ARCHITECTURE; SPEED;

DESIGN AND OPERATIONS; LINUX KERNEL; MULTI-CORE SYSTEMS; MULTICORE ARCHITECTURES; NETWORK APPLICATIONS; NETWORK INTERFACE CARDS; NETWORK PACKET CAPTURE; TRANSMIT FUNCTION;

HIGH SPEED NETWORKS;

EID: 84910131365     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2663716.2663736     Document Type: Conference Paper

References (32)

1. M. Roesch, Snort: Lightweight Intrusion Detection for Networks. In USENIX LISA (Nov. 1999), pp. 229-238.
2. A. Papadogiannakis, M. Polychronakis, and E. P. Markatos, Improving the accuracy of network intrusion detection systems under load using selective packet discarding. In ACM ERUOSEC (2010), pp. 15-21.
3. M. Jamshed, J. Lee, S. Moon, I. Yun, D. Kim, S. Lee, Y. Yi, and K. Park, Kargus: A highly-scalable software-based intrusion detection system. In ACM CCS (Oct. 2012), pp. 317-328.
4. V. Paxson, Automated packet trace analysis of TCP implementations. ACM SIGCOMM CCR 27, 4 (1997).
5. S. A. Crosby and D. S. Wallach. Denial of service via algorithmic complexity attacks. In USENIX Security (Aug. 2003), pp. 29-44.
6. http://www.endace.com/endace-dag-high-speed-packetcapture-cards.html.
7. http://www.napatech.com/.
8. F. Fusco, and L. Deri, High speed network traffic analysis with commodity multi-core systems. In ACM IMC (2010), pp. 218-224.
9. L. Braun, A. Didebulidze, N. Kammenhuber, and G. Carle, Comparing and improving current packet capturing solutions based on commodity hardware. In ACM IMC (2010), pp. 206-217.
10. N. Bonelli, A. Di Pietro, S. Giordano, and G. Procissi, On multi-gigabit packet capturing with multi-core commodity hardware. In PAM (2012), pp. 64-73.
11. W. Wu, P. DeMar, and M. Crawford, A transport-friendly NIC for multicore/multiprocessor systems. Parallel and Distributed Systems, IEEE Transactions on, 23(4), 607- 615.
12. C. F. Dcumitrescu, Models for packet processing on multicore systems. http://www.intel.com/content/www/us/en/intelligentsystems/intel-technology/ia-multicore-packet-processingpaper.html.
13. T. Benson, A. Akella, and D. A. Maltz, Network traffic characteristics of data centers in the wild. In ACM IMC (2010), pp. 267-280.
14. PF-RING. www.ntop.org/products/pf-ring/.
15. L. Rizzo, netmap: A novel framework for fast packet I/O. In USENIX ATC (2012).
16. DNA. www.ntop.org/products/pf-ring/dna/.
17. H. K. J. Chu, Zero-copy TCP in Solaris. In Proceedings of the 1996 annual conference on USENIX Annual Technical Conference (pp. 21-21). Usenix Association.
18. P. Druschel, and G. Banga, Lazy receiver processing (LRP): A network subsystem architecture for server systems. In OSDI (Vol. 96, pp. 261-275).
19. A. Foong, T. Huff, H. Hum, J. Patwardhan, and G. Regnier, TCP performance re-visited. In Performance Analysis of Systems and Software, 2003. ISPASS. 2003 IEEE International Symposium on (pp. 70-79). IEEE.
20. TCPDUMP and LIBPCAP public repository. http://www.tcpdump.org/.
21. W. Wu, M. Crawford, and M. Bowden, The performance analysis of Linux networking-packet receiving, Computer Communications, 30(5), 1044-1057.
22. Intel 82599 10GbE Controller Datasheet. http://www.intel.com/content/www/us/en/ethernetcontrollers/82599-10-gbe-controller-datasheet.html.
23. S. Han, K. Jang, K. Park, and S. Moon, Packet Shader: A GPU-accelerated software router. ACM SIGCOMM Computer Communication Review, 41.4 (2011), 195-206.
24. J. Mogul, and K. K. Ramakrishnan, Eliminating receive livelock in an interrupt-driven kernel. In ACM Transactions on Computer Systems 15.3 (1997): 217-252.
25. S. McCanne and V. Jacobson, The BSD packet filter: A new architecture for user-level packet capture. In Winter USENIX Conference, 1993.
26. J. S. White, T. Fitzsimmons, and J. N. Matthews, Quantitative analysis of intrusion detection systems: Snort and Suricata. In SPIE Defense, Security, and Sensing, pp. 875704-875704.
27. A. Basu, J. Gandhi, J. Chang, M. D. Hill, and M. M. Swift, (2013, June). Efficient virtual memory for big memory servers. In ACM ISCA (2013): pp. 237-248.
28. V. Moreno, P. Santiago del Rio, J. Ramos, J. Garnica, and J. Garcia-Dorado, Batch to the future: Analyzing timestamp accuracy of high-performance packet I/O engines, IEEE Communications letters, 16(11): 1888- 1891, 2012.
29. D. Geer, Chip makers turn to multicore processors. Computer, 38(5), 11-13, 2005.
30. W. Wu, P. DeMar, and M. Crawford, Why can some advanced Ethernet NICs cause packet reordering?. IEEE Communications Letters, 15(2): 253-255, 2011.
31. Intel DPDK website. http://dpdk.org.
32. H. J. Koch, "Userspace I/O drivers in a realtime context", [Online], Available: https://www.osadl.org/fileadmin/dam/rtlws/12/Koch.pdf.