An efficient tcp flow reassembling algorithm based on PF_RING

Abstract

Along with the development of Internet/Intranet application, more and more sensitive data is transmitted through the network. In order to prevent the critical data from being divulged and guarantee the security of information, we should pay more attention to the surveillance of network traffic. With this motivation, we present an efficient TCP flow reassembling algorithm which is the key of dataflow processing. Through this method, it is possible to get a whole idea of every TCP flow and providing a good reference to judgment. Testing of a prototype based on PF_RING demonstrated that our mechanism take a good performance in linux kernel 2.6.28.