摘要： 提出了一种基于用户空间的捕包平台设计――ULPF(User Level Packet Filter)。系统完全在用户空间实现;通过修改网卡驱动将数据绕过操作系统内核直接提交给用户空间避免了耗时的数据拷贝操作;利用网络数据包长度的局部性实现了一个高效的内存分配算法避免了多线程带来的内存分配开销。实验证明,该平台基本可以实现将网络数据流线速还原到TCP层。

关键词: 捕包, 网络协议栈, 内核, 内存分配

Abstract: This paper designs a packet capture system ULPF(User Level Packet Filter),which is completely implemented in user level.With optimizing network driver,people bypass kernel and put packets to user level directly so that they can avoid data copying which is time consuming.Advantage of the locality of packets length is taken to design an efficient memory allocator instead of malloc which will show its inefficiency inmultithread environment.The test result indicates that this system can process TCP packets almost at line speed.

中图分类号: 

• TP393.09