A Kernel-Level Monitor over Multiprocessor Architectures for High-Performance Network Analysis with Commodity Hardware

Abstract

Traffic monitoring is an increasingly important discipline for nowadays networking, as Accounting, Security and also Quality of Service (QoS) lay on it. Besides, traffic bandwidth has increased exponentially in the last few years, and high-speed network monitoring is a challenging aim. Performance requirements are highly relevant for monitoring systems. A low-level study of the capturing stages on a traffic analysis system (TAS) has shown room for improvement. We provide an architecture able to cope with high-speed traffic monitoring using commodity hardware. Our design is also intended to exploit the parallelism available in up-to-date workstations. This paper presents a kernel-level monitoring system (ksensor) that, keeping the previous requirements, removes some issues from user-level processing, improving the overall performance.