Improved PF_RING for High Performance Packet Capture

개선된 PF_RING을 이용한 고성능 패킷 캡쳐

The packet capturing becomes a bottleneck in the network intrusion detection and monitoring system as the network performance developing. Many approaches, zero copy, interrupt coalescing and NAPI which attempt to improve packet capturing performance of Linux, are inefficient. PF_RING is a new type of network socket that dramatically improves the packet capture speed, but not perfect. This paper proposes some solutions which can improve the memory utilization and save some data copy time based on the commodity network adapters rather than on the commercial network adapters.