Packet Capture Engine for Commodity NICs in High-Speed Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Packet capture in high-speed networks faces challenges such as packet drops due to inability to keep pace with incoming packet rates, leading to degraded accuracy and integrity of network monitoring applications, particularly due to load imbalance and limited buffering capabilities in existing packet capture engines.
Innovation Solution
A novel packet capture engine for commodity network interface cards that addresses load imbalance by utilizing a ring-buffer-pool mechanism for short-term bursts and a buddy group offloading system to handle long-term imbalances, ensuring zero-copy packet delivery and efficient packet processing through kernel-mode drivers and user-space modules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If packet capture is performed at high speed, then network monitoring capability is improved, but packet drop increases due to inability to keep pace with incoming packet rate
Solution Approach 1:
The packet capture system is segmented into multiple receive queues (e.g., 8 queues) that are distributed across multiple CPU cores. Each queue is handled by a dedicated capture thread, dividing the high-speed packet stream into manageable segments that can be processed in parallel, thereby maintaining high capture speed while preventing packet loss through distributed processing capacity
Solution Approach 2:
The system transitions from single-queue sequential processing to multi-queue parallel processing across multiple CPU cores. This dimensional change from one-dimensional sequential capture to multi-dimensional parallel capture enables the system to handle high packet rates by utilizing additional processing dimensions (multiple cores and queues simultaneously)
2Ease of operation
If traffic steering is applied to distribute traffic evenly, then load balance is improved, but application logic is lost
Solution Approach 1:
Receive queues are pre-configured and pre-associated with specific CPU cores and capture threads before packet arrival. Application logic is pre-embedded in the kernel-mode driver, which automatically routes packets to the correct queues based on predefined rules. This preliminary setup enables automatic load balancing without requiring application-layer intervention, preserving application logic while achieving even traffic distribution
3Ease of manufacture
If existing packet capture engines are used, then implementation simplicity is maintained, but load imbalance cannot be effectively handled due to lack of low-level knowledge in user space applications
Solution Approach 1:
A kernel-mode driver acts as an intermediary between the network interface card and user-space applications. This intermediary layer has direct access to low-level hardware information and queue states, enabling it to make intelligent load-balancing decisions at the optimal level. The driver manages multiple receive queues and CPU core assignments while presenting a simple interface to applications, combining implementation simplicity with advanced load-balancing capabilities
Data Source
AI summary
A method, systems for a packet capture engine for commodity network interface cards (NICs) in high-speed networks that provides lossless zero-copy packet capture and delivery services by exploiting multi-queue NICs and multicore architectures. The methods, systems include a ring-buffer-pool mechanism and a buddy-group based offloading mechanism.