Abstract:
In this article, we design and implement a full-packet capture and network measurement (FPC-NM) system in a 20 Gbit/s network. The system has multiple functions, such as ...Show MoreMetadata
Abstract:
In this article, we design and implement a full-packet capture and network measurement (FPC-NM) system in a 20 Gbit/s network. The system has multiple functions, such as packet receiving, nanosecond timestamp, load balancing, data packet preprocessing, application layer protocol analysis, data packet storage, and log management. We design a timestamp module in field programmable gate array (FPGA) that can add a timestamp to each captured packet, and the retrospective packet analysis can be done with 4 ns accuracy. As far as we know, this is the first time that nanosecond timestamp has been applied to FPC-NM system, which greatly improves the accuracy of security incident retrospective analysis. The experimental results show that the FPC-NM system can achieve 17 Gbit/s throughput and 160 000 connections per second under the premise of zero packet loss. Using LZ4 compression, the performance of our system for real-time compression and storage of traffic can achieve 10 Gbit/s. The system performance is improved by about 40% after software optimization including direct memory access buffer size adjustment and single instruction, multiple data (SIMD) instruction set, which validates the practicability and effectiveness of our optimization method.
Published in: IEEE Transactions on Instrumentation and Measurement ( Volume: 70)