基于Linux的一種快速數據包捕獲方法

論文字數:20107,頁數:48  有開題報告，任務書
 摘   要
 隨著網絡規模的不斷擴大，網絡異構程度不斷加深，計算機網絡變得日益復雜，迫切需要對網絡的流量進行實時、在線的監控和管理。網絡流量監測分析可以獲得詳細的流量特征，如流量大小、協議分布、數據包大小分布等信息，從而指導網絡運維、管理與規劃設計。
 網絡流量監測分析必須解決的一個技術難點是如何實現高速鏈路的數據包捕獲。采用專用硬件價格比較昂貴，且缺乏靈活性；傳統的基于軟件實現的捕包方法由于受到硬件性能和操作系統開銷的影響，只適用于百兆及以下速率的低速鏈路中。除去硬件系統—CPU， PCI， Memory， Cache機制等本身固有的處理能力限制外，本文分析了傳統基于軟件的數據包捕獲方法所存在的局限性，研究如何控制其實現過程中的開銷，進而實現了一種基于Linux內核的高速鏈路數據包捕獲方法，該方法在通用PC上實現，適應Gigabits級高速鏈路環境。實驗表明，基于內核的捕包方法降低了系統調用和內存拷貝，提高了流量分析的能力，與libpcap捕包能力相比有明顯的提高。
 
關鍵字：數據包捕獲,libpcap,內存拷貝,系統調用,內核模塊 
 An Efficient Packet Capture Method Based On Linux
 
 Abstract
 With the rapid development of network technologies, networks are becoming more and more complicated as the scale of networks are expanding, new applications are emerging, and the heterogeneity of networks is deepening. It is necessary to monitor networks traffic in real time and manage networks on-line. Through network traffic measurement, we can obtain the details of the traffic, such as link utilization, the distribution of the different protocols, the distribution of packet size, and so on. It will guide the maintenance and management of networks and facilitate the design of networks.
 There are many challenges in high-speed network traffic monitoring; one of the most important bottlenecks is packet capturing. But it is too expensive and lack of flexibility to use the special hardware. Because of hardware capability and operating system overhead limitations, the existing network traffic monitoring tools based on software can only perform well at low speed network with the link rate below 100Mbps.Except the limit of hardware system like CPU, PCI, Memory, Cache. This thesis analysis the limit of traditional methods of captured data packet. We also analysis the overhead of its process of Implementation and then Implement a methods which is based on common PC and linux kernel and suit for GE high-speed network. The method which makes use of the characters of kernel module, reduces the overhead of system calls and memory copy times. The experiments show that the method which makes use of the characters of kernel module can enhance the performance much than one traffic analysis tool based on Libpcap.
 
Key Words: Packet Capture,libpcap,Memory Copy,system call,kernel module
  
 

 目 錄
 
1．緒論 1
1.1 研究背景 1
1.2 研究意義 2
1.3 研究現狀 2
1.4 本文結構 3
2．網絡流量監測概述 5
2.1 網絡流量的基本概念 5
2.1.1 網絡流量的基本定義 5
2.1.2數據包監測的定義 5
2.1.3中斷活鎖的概念 6
2.2 網絡監聽原理 6
2.2.1 以太網監聽原理 6
2.2.2 網卡的四種工作模式 7
2.3 Linux操作系統數據包捕獲方法 8
2.3.1 Linux系統接收數據包的過程 9
2.3.2 Linux系統中流量分析性能影響因素 10
3．基于內核捕包方案的分析 12
3.1 常規的數據包捕獲方案 12
3.1.1 Libpcap 12
3.1.2 Libpcap的傳統捕獲機制影響 12
3.1.3 Libpcap捕包方法的不足 13
3.2存在的性能提升空間 14
3.3 基于內核捕包方案原理 15
3.3.1 Linux內核的數據包處理 15
3.3.2 基于Linux內核的捕包方案原理 16
3.4基于內核捕包方案性能分析 17
4．基于內核捕包方案的設計與實現 19
4.1設計概述 19
4.2 實現方案 20
4.2.1 實現的環境 20
4.2.2 方案的實現 20
4.3實現結果 24
5．實驗結果分析 27
5.1 實驗環境 27
5.1.1 libnet簡介 27
5.1.2實驗室環境配置 28
5.2數據包捕獲能力測試 29
5.3數據包深度分析能力測試 30
5.4 結論 31
6.總結與展望 33
致謝 34
參考文獻 35
附錄A 主要源程序 36