Fernández Alonso, Daniel
Conference Papers
Comparing network traffic probes based on commodity hardware
Luis Zabala, Alberto Pineda, Armando Ferro, Daniel Fernández
The Thirteenth International Conference on Networks (ICN 2014)
Nice, France
February 23-27, 2014
Nice, France
February 23-27, 2014
ABSTRACT
Due to the fact that, nowadays, it is possible to capture traffic in 1-10 Gigabit Ethernet networks using commodity hardware, many traffic monitoring systems, and especially capturing tools, have been proposed in recent years. This paper presents a comparison between two software probes named Adviser and Ksensor. Both of them are multi-processor systems and are built over conventional hardware. However, while Adviser is designed in user space, Ksensor runs in kernel space. This work compares the performance results of the two probes considering several capture engines (NAPI, PF_RING with DNA, PFQ) and, at the same time, different application or analysis loads. The evaluations of the probes with the different settings have been performed on the same hardware multi-core configuration. The results of the evaluations let conclude which solution is better in each situation and which solution must be discarded.
Due to the fact that, nowadays, it is possible to capture traffic in 1-10 Gigabit Ethernet networks using commodity hardware, many traffic monitoring systems, and especially capturing tools, have been proposed in recent years. This paper presents a comparison between two software probes named Adviser and Ksensor. Both of them are multi-processor systems and are built over conventional hardware. However, while Adviser is designed in user space, Ksensor runs in kernel space. This work compares the performance results of the two probes considering several capture engines (NAPI, PF_RING with DNA, PFQ) and, at the same time, different application or analysis loads. The evaluations of the probes with the different settings have been performed on the same hardware multi-core configuration. The results of the evaluations let conclude which solution is better in each situation and which solution must be discarded.
Integración de PF_RING en el sensor de análisis de tráfico Adviser
Daniel Fernández, Armando Ferro, Luis Zabala, Alberto Pineda
XXVII Simposium Nacional URSI
Elche, Spain.
September 12-14, 2012
Elche, Spain.
September 12-14, 2012
ABSTRACT
Adviser is a user-space software which allows to capture and analyze traffic in high speed networks. This paper describes the integration of PF_RING library, kernel module and optional drivers into Adviser platform, to enhance the packet capturing. Adviser packet capturing is made through standard Linux Libpcap library and offers good performance and flexibility. PF_RING increases the packet capturing adding a new kernel module which speeds up the packet copying from kernel space to user-space. Therefore this integration will improve Adviser's traffic monitoring performance, reducing the CPU consumption in packet capturing
Adviser is a user-space software which allows to capture and analyze traffic in high speed networks. This paper describes the integration of PF_RING library, kernel module and optional drivers into Adviser platform, to enhance the packet capturing. Adviser packet capturing is made through standard Linux Libpcap library and offers good performance and flexibility. PF_RING increases the packet capturing adding a new kernel module which speeds up the packet copying from kernel space to user-space. Therefore this integration will improve Adviser's traffic monitoring performance, reducing the CPU consumption in packet capturing