Performance Characteristics of a Kernel-Space Packet Capture Module

By Samuel W Birch

This research attempts to improve the efficiency of capturing network packets to disk using commodity, general-purpose hardware and operating systems. It examines the bottlenecks between NIC and disk, implements a kernel-space capture capability to improve storage effciency, and analyzes the performance characteristics of this approach. Results show that a kernel-space NIC-to-Disk capture module is both possible and beneffcial. The proof of concept PKAP kernel-space packet capture module can capture packets to disk with a packet drop rate 8.9% less than the user-space equivalent, at a 95% confidence interval. During the high levels of disk I/O contention produced by queries for the captured data, the PKAP implementation shows a 3% reduction in CPU utilization, and overall the PKAP implementation reduces memory utilization of the capture process by 16%.

• Format: Paperback
• Language: English
• ISBN: 1249586917
• ISBN13: 9781249586913
• Release Date: October 2012
• Publisher: Biblioscholar
• Length: 136 Pages
• Weight: 0.56 lbs.
• Dimensions: 0.3" x 7.4" x 9.7"