nCap: wire-speed packet capture and transmission

Deri, Luca

doi:10.1109/e2emon.2005.1564468

Cited by 64 publications

(38 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Researchers have demonstrated that packet capture, the cornerstone of the majority of passive monitoring applications, can be substantially improved by enhancing general purpose operating systems for traffic analysis [11,12,26]. These results are encouraging because today's commodity hardware offers features and performance that just a few years ago were only provided by costly custom hardware design.…”

Section: Introductionmentioning

confidence: 58%

High speed network traffic analysis with commodity multi-core systems

Fusco

Deri²

2010

Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement

132

View full text Add to dashboard Cite

Multi-core systems are the current dominant trend in computer processors. However, kernel network layers often do not fully exploit multi-core architectures. This is due to issues such as legacy code, resource competition of the RXqueues in network interfaces, as well as unnecessary memory copies between the OS layers. The result is that packet capture, the core operation in every network monitoring application, may even experience performance penalties when adapted to multi-core architectures. This work presents common pitfalls of network monitoring applications when used with multi-core systems, and presents solutions to these issues. We describe the design and implementation of a novel multi-core aware packet capture kernel module that enables monitoring applications to scale with the number of cores. We showcase that we can achieve high packet capture performance on modern commodity hardware.

show abstract

Section: Introductionmentioning

confidence: 58%

High speed network traffic analysis with commodity multi-core systems

Fusco

Deri²

2010

Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement

132

View full text Add to dashboard Cite

show abstract

“…Commercial products such as DAG Packet Capture Cards [9] are designed for zero-loss packet capture. Besides commercial solutions, the nCap architecture is presented to create a straight path from the network adapter to the user-space by means of memory mapping for wire-speed packet capture [10]. Although highperformance packet capture is not the purpose of this work, this work can adopt these solutions if the live environment is a high-speed network.…”

Section: Related Workmentioning

confidence: 99%

On-the-Fly Capture and Replay Mechanisms for Multi-Port Network Devices in Operational Networks

Lin

et al. 2014

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

Abstract-Testing network devices in a live environment is desirable due to its reality. However, the defects are not reproducible, and the network connectivity will be broken if the device is down. For effective defect reproduction from real traffic, we design a new mechanism, which allows the device under test (DUT) to be automatically online/offline, and supports multiport replay for multi-port network devices with an OpenFlow switch. The defect traces are captured when the DUT is online. When a DUT failure is detected, the DUT will be offline, and the defect-triggering traces will be replayed to identify the defect. For efficient replay, we keep only partial payloads in a reduced number of packets in the defect traces that are sufficient to trigger the defects. For defect identification, reduction based on a binary search algorithm is presented to deal with the defects caused by payload anomalies and by overloading. The downsizing ratios in the cases of payload anomalies and overloading are up to 98.8% and 96%, respectively. The minimum outage time of the failover during the DUT failure is obtained when the check interval is 1 second and the number of tolerable consecutive failures is 2.

show abstract

“…If this happens, then regardless of clock method the results will be compromised. An ideal solution is to use the TSC method in combination with code that is executed by the kernel, for instance the network driver [17,18] where scheduling effects can be minimized.…”

Section: Timestampsmentioning

confidence: 99%

Application Level Measurement

Arlos

2011

Network Performance Engineering

View full text Add to dashboard Cite

Abstract. In some cases, application-level measurements can be the only way for an application to get an understanding about the performance offered by the underlying network(s). It can also be that an application-level measurement is the only practical solution to verify the availability of a particular service. Hence, as more and more applications perform measurements of various networks; be that fixed or mobile, it is crucial to understand the context in which the application level measurements operate their capabilities and limitations. To this end in this paper we discuss some of the fundamentals of computer network performance measurements and in particular the key aspects to consider when using application level measurements to estimate network performance properties.

show abstract

nCap: wire-speed packet capture and transmission

Cited by 64 publications

References 3 publications

High speed network traffic analysis with commodity multi-core systems

High speed network traffic analysis with commodity multi-core systems

On-the-Fly Capture and Replay Mechanisms for Multi-Port Network Devices in Operational Networks

Application Level Measurement

Contact Info

Product

Resources

About