High-speed capturing method of bottom-layer data packet based on Linux

Abstract

The invention provides a high-speed capturing method of a bottom-layer data packet based on Linux. By setting a virtual capturing equipment module (VUKM module) to modify a network card driver, the high-speed capturing method leads the data packet reaching to a network card to be capable of bypassing a kernel protocol to be directly passed to a subsequence module for processing so as to realize memory sharing of a user space and a kernel space; and the kernel space transmits the data packet to an upper-layer analysis processing interface module at a high speed, and provides a mechanism for leading an upper-layer application program and the network card to access the VUKM module in a conflict-free manner so as to make further processing to the captured data packet. The high-speed capturing method can acquire the original data packet by the network card at a high speed under the gigabit network environment, and can overcome the defect of the traditional data packet capturing technology, thus improving the acquisition efficiency.

Description

technical field [0001] The invention relates to a high-speed capture method of data packets based on a gigabit network card in a Linux environment, and belongs to the field of information security. Background technique [0002] With the advent of the gigabit network era, the traditional packet capture mechanism has become the performance bottleneck of the entire system. First, the network message is received by the Linux kernel with a single message-driven mechanism, and the kernel performs operations such as buffer application and header verification for each message indiscriminately; second, the message processing program passes the system call every time Only one message is read from the kernel; third, the message needs to be transmitted to the user space where the message processing program is located through multiple memory copies. Ordinary network card and Libpcap interface are enough to ensure that the network packet processing programs running in Linux user space, s...

AI Technical Summary

Problems solved by technology

[0007] Due to the advent of the gigabit network era, traditional packet capture has encountered performance bottlenecks

Images