Method for fast catching Ethernet card on Linux system

Abstract

The invention discloses a method for utilizing an Ethernet-card to rapidly capture packet on a Linux system, the method comprises mapping an Ethernet-card DMA receiving caching area on a user area, achieving the purpose of simultaneously capturing packets for a plurality of Ethernet cads through reducing data packets to reach a user area and copying times of a user program and starting a thread packet capture with every Ethernet card, reducing dispatching cost of interrupt handling through shutting interruption to actively enquire and receive, defining cache and management thereof which are repeatedly used, reducing cache application and releasing cost, reducing the conflict of visiting cache between the packet capture thread and packet processing thread, realizing the rapid capture of Ethernet data packets and ip packets which are transferred on the Ethernet data packets.

Description

1. Technical field [0001] The invention relates to the field of computer communication, in particular to a method for quickly capturing packets of an Ethernet card on a Linux system. 2. Technical background [0002] At present, LAN is widely used. Ethernet is a kind of LAN, and it is also the mainstream mode of LAN. The ip packet can be transmitted on the Ethernet to realize the connection with the tcp / ip Internet. In network management and network detection, it is necessary to capture the transmitted network data packets, and then analyze the network traffic, monitor and intrude the communication of the specified source address and destination address, etc. In order to improve performance such as monitoring speed, it is necessary to capture data packets completely or as completely as possible. [0003] On the Linux system, the traditional Ethernet card driver and the network processing stack of the kernel are affected by the interrupt scheduling of the Ethernet card, and ...

AI Technical Summary

Problems solved by technology

[0004] (1) The non-NAPI method is completely triggered by the network card interrupt to receive the data packet. When the packet comes at a high frequency, the network card interrupt processing scheduling requires a large CPU resource consumption.

[0005] (2) The NAPI method combines network card interrupt triggering and active query reception. Although the number of interrupt scheduling is greatly reduced, each polling has a fixed time (1 system clock cycle) jiffies ) limit, exceeding this time value will end receiving, so it is difficult to guarantee that no packets will be lost after polling

[0007] (4) Regardless of the non-NAPI mode or the NAPI mode, the length of the received data packet cache queue is very limited. When the data packet processing speed is uneven, it is easy to cause the buffer area to be full and cause packet loss. make a copy

Images