替代pcap（Linux）

Question

On a Linux router I wrote a C-program which uses pcap to get the IP header, and length of the packet. In that way I am able to gather statistics and measure bandwidth based on IP. Pretty neat. :-)

Now the traffic and number of users has grown, and the old program starts to struggle. That is, the router struggles to cope with the massive amount of packets. It's over 50000 packets per second all in all in "prime time".

The program itself is pretty optimized. I don't want to show off, but I believe it's as good as it can get. It reads the IP header, and the packet length. It then converts the IP to a index (just a simple subtract), and the length of the packet is stored (accumulated) in an array. Every now and then (actually a SIGALRM) it stores the array in a MySQL database.

My question is: Is there any other way to tap into an ethernet device to get the bit-stream "cheaper" than pcap?

I can of course modify the ethernet driver to include single IP statistics gathering, but that seems a little overkill.

Basically my program is a 'tcpdump' on a busy eth0 and that will eventually kill my router.

Answer 1

Have you considered PF_RING ? It's still the pcap -like world, but on steroids - thanks to the zero-copy mechanism:

As you see, there is a kernel module that provides low-level packet copying into the PF_RING buffer, and there is the userland part that allows to access this buffer.

Who needs PF_RING?

Basically everyone who has to handle many packets per second. The term 'many' changes according to the hardware you use for traffic analysis. It can range from 80k pkt/sec on a 1,2GHz ARM to 14M pkt/sec and above on a low-end 2,5GHz Xeon. PF_RING not only enables you to capture packets faster, it also captures packets more efficiently preserving CPU cycles....

Answer 2

I highly recommend you to use PF_RING ZC. It could be found under /userland/examples_zc. it is part of pf_ring.

you can handle and capture tens of Gbps traffics in line rate by pf_ring zc.