1. A Multifunctional Full-Packet Capture and Network Measurement System Supporting Nanosecond Timestamp and Real-Time Analysis.
- Author
-
Han, Luchao, Guo, Zhichuan, Huang, Xiaoying, and Zeng, Xuewen
- Subjects
- *
FIELD programmable gate arrays , *DATA packeting - Abstract
In this article, we design and implement a full-packet capture and network measurement (FPC-NM) system in a 20 Gbit/s network. The system has multiple functions, such as packet receiving, nanosecond timestamp, load balancing, data packet preprocessing, application layer protocol analysis, data packet storage, and log management. We design a timestamp module in field programmable gate array (FPGA) that can add a timestamp to each captured packet, and the retrospective packet analysis can be done with 4 ns accuracy. As far as we know, this is the first time that nanosecond timestamp has been applied to FPC-NM system, which greatly improves the accuracy of security incident retrospective analysis. The experimental results show that the FPC-NM system can achieve 17 Gbit/s throughput and 160 000 connections per second under the premise of zero packet loss. Using LZ4 compression, the performance of our system for real-time compression and storage of traffic can achieve 10 Gbit/s. The system performance is improved by about 40% after software optimization including direct memory access buffer size adjustment and single instruction, multiple data (SIMD) instruction set, which validates the practicability and effectiveness of our optimization method. [ABSTRACT FROM AUTHOR]
- Published
- 2021
- Full Text
- View/download PDF