Ringmap Capturing Stack for High Performance Packet Capturing in FreeBSD
Packet capturing in high-speed networks is not an easy task due to the system limitations such as RAM and system bus throughput. Unfortunately, it is often impossible to capture every packet arriving at the network interface. Hardware may not be the only bottleneck, however, as inefficient software is also to blame for poor resources usage and the resulting packet loss during capture.
The new ringmap capturing stack for FreeBSD already allows for efficient capturing at 1GBit/sec on commodity hardware with very low packet loss and low system load. Under similar conditions, with Intel 1GbE cards and 64 bytes packets, the standard capturing software of FreeBSD-7.x during capturing generates a system load of up to 100% and results in close to 100% packet loss.
Similar to “zero-copy BPF” implementation, our idea is to eliminate packet copy operations by using shared memory buffers. However, unlike the “zero-copy BPF” model, ringmap eliminates all packet copies during capturing: the network adapter's DMA buffer is mapped directly into the user-space. Ringmap also adapts libpcap accordingly to provide user-space applications with access to the captured packets without any additional overhead.