DiCAP: Distributed Packet Capturing architecture for high-speed network links

Abstract

IP traffic measurements form the basis of several network management tasks, such as accounting, planning, intrusion detection, and charging. High-speed network links challenge traditional IP traffic analysis tools with their high amount of carried data that needs to be processed within a small amount of time. Centralized traffic measurements for high-speed links typically require high-performance capturing hardware that usually comes with a high cost. Software-based capturing solutions, such as libpcap or PFRING, cannot cope with those high data rates and experience high packet losses. Thus, this paper proposes a scalable architecture and its implementation for Distributed Packet Capturing (DiCAP) based on inexpensive off-the-shelf hardware running Linux operating system. The prototype designed has been tested as an implementation and was evaluated against other Linux capturing tools. The evaluation shows that DiCAP can perform loss-less IP packet header capture at high-speed packet rates when used alone and that it can highly improve the performance of libpcap of PFRING when used in combination with those.