High Speed Network Traffic Analysis With Commodity Multi-Core Systems

Multi-core systems are the current dominant trend in computer processors. However, kernel network layers often do not fully exploit multi-core architectures. This is due to issues such as legacy code, resource competition of the RX-queues in network interfaces, as well as unnecessary memory copies between the OS layers. The result is that packet capture, the core operation in every network monitoring application, may even experience performance penalties when adapted to multi-core architectures. This work presents common pitfalls of network monitoring applications when used with multi-core systems, and presents solutions to these issues. The authors describe the design and implementation of a novel multi-core aware packet capture kernel module that enables monitoring applications to scale with the number of cores.