On Multi–gigabit Packet Capturing with Multi–core Commodity Hardware

  • Nicola Bonelli
  • Andrea Di Pietro
  • Stefano Giordano
  • Gregorio Procissi
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 7192)


Nowadays commodity hardware is offering an ever increasing degree of parallelism (CPUs with more and more cores, NICs with parallel queues). However, most of the existing network monitoring software has not yet been designed with high parallelism in mind. Therefore we designed a novel packet capturing engine, named PFQ, that allows efficient capturing and in–kernel aggregation, as well as connection–aware load balancing. Such an engine is based on a novel lockless queue and allows parallel packet capturing to let the user–space application arbitrarily define its degree of parallelism. Therefore, both legacy applications and natively parallel ones can benefit from such a capturing engine. In addition, PFQ outperforms its competitors both in terms of captured packets and CPU consumption.


Hash Function User Space Incoming Packet Legacy Application Software Router 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
  2. 2.
    Deri, L.: ncap: wire-speed packet capture and transmission. In: End-to-End Monitoring Techniques and Services on 2005, pp. 47–55. IEEE Computer Society, Washington, DC (2005)CrossRefGoogle Scholar
  3. 3.
  4. 4.
  5. 5.
    Libpcap MMAP mode on linux Phil Woods,
  6. 6.
    Fusco, F., Deri, L.: High speed network traffic analysis with commodity multi-core systems. In: IMC 2010, pp. 218–224 (2010)Google Scholar
  7. 7.
    Egi, N., Greenhalgh, A., Handley, M., Hoerdt, M., Huici, F., Mathy, L., Papadimitriou, P.: Forwarding path architectures for multicore software routers. In: Proc. of PRESTO 2010, pp. 3:1–3:6. ACM, New York (2010)Google Scholar
  8. 8.
    Kohler, E., Morris, R., Chen, B., Jannotti, J., Frans Kaashoek, M.: The click modular router. ACM Trans. Comput. Syst. 18, 263–297 (2000)CrossRefGoogle Scholar
  9. 9.
    Dobrescu, M., Egi, N., Argyraki, K., Chun, B., Fall, K., Iannaccone, G., Knies, A., Manesh, M., Ratnasamy, S.: Routebricks: exploiting parallelism to scale software routers. In: ACM SIGOPS, pp. 15–28. ACM, New York (2009)Google Scholar
  10. 10.
    Han, S., Jang, K., Park, K., Moon, S.: Packetshader: a gpu-accelerated software router. In: Proceedings of the ACM SIGCOMM 2010 Conference on SIGCOMM, SIGCOMM 2010, pp. 195–206. ACM, New York (2010)Google Scholar
  11. 11.
    Han, S., Jang, K., Park, K., Moon, S.: Building a single-box 100 gbps software router. In: IEEE LANMAN (2010)Google Scholar
  12. 12.
    Bonelli, N., Di Pietro, A., Giordano, S., Procissi, G.: Flexible high performance traffic generation on commodity multi-core platforms. In: To appear in Traffic Monitoring and Analysis (TMA 2012) Workshop (2012)Google Scholar
  13. 13.
    Bonelli, N., Di Pietro, A., Giordano, S., Procissi, G.: Packet capturing on parallel architectures. In: IEEE Workshop on Measurements and Networking (2011)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2012

Authors and Affiliations

  • Nicola Bonelli
    • 1
  • Andrea Di Pietro
    • 1
  • Stefano Giordano
    • 1
  • Gregorio Procissi
    • 1
  1. 1.CNIT and Università di PisaPisaItaly

Personalised recommendations