The capacity of today's network links, along with the heterogeneity of their traffic, is rapidly growing, more than the workstation's processing power. This makes the task of measuring traffic more problematic every day, especially when off-the-shelf hardware is used. A general solution adopted by the computer industry to achieve better performance is to partition the processing among different computing units, exploiting the implicit or explicit parallelism available on today workstations. Parallelism is in fact growing in two dimensions: physical and logical CPUs (e.g. HyperThreading). Unfortunately, most network measurement systems are engineered to process data in a set of sequential tasks; thus, completely ignoring any form of parallelism provided by the hardware. This paper introduces a new approach to build high performance and scalable network measurement tools. It discusses the problem of dispatching packets to different processing entities and describes a technology able to distribute the flow of incoming packets among different processors in an effective and configurable manner, that avoids any copy and optimizes resource usage.

A large set of tools for network monitoring and accounting, security, traffic analysis and prediction - more broadly, for network operation and management - require direct and efficient real-time access to data traveling on the network. Software tools are often preferred because of their low cost and high versatility. However, these tools are often considered to suffer from performance problems on high-speed networks. We demonstrate that, despite the common belief, the performance limits for software real-time network analysis tools are still far from being reached and it can even be improved with limited hardware support. We analyze the performance of a widely used library for network analysis, WinPcap, highlight its bottlenecks, and propose some solutions that almost double the overall speed, thus enabling the deployment of software-based tools on high speed networks.

Traffic monitoring and analysis based on general purpose systems with high speed interfaces, such as Gigabit Ethernet and 10 Gigabit Ethernet, requires carefully designed software in order to achieve the needed performance. One approach to attain such a performance relies on deploying multiple processors. This work analyses some general issues in multiprocessor systems that are particularly critical in the context of packet capture and network monitoring applications. More important, a new algorithm is proposed to coordinate multiple producers concurrently accessing a shared buffer, which is instrumental in packet capture on symmetrical multiprocessor machines.

Most Unix systems provide a set of system calls that allow applications to interact with the network directly. These primitives are useful for example in packet capture applications, which need to grab the data flowing through the network without any further processing from the kernel. WinPcap is a newly proposed architecture that adds these functionalities to Win32 operating systems. WinPcap includes a set of innovative features (such as packet monitoring and packet injection) that are not available in previous systems. This paper presents the details of the architecture and it shows its excellent performance.