DiCAP: Distributed Packet Capturing architecture for high-speed network links

— IP traffic measurements form the basis of several network management tasks, such as accounting, planning, intrusion detection, and charging. High-speed network links challenge traditional IP traffic analysis tools with their high amount of carried data that needs to be processed within a small amount of time. Centralized traffic measurements for high-speed links typically require highperformance capturing hardware that usually comes with a high cost. Software-based capturing solutions, such as libpcap or PFRING, cannot cope with those high data rates and experience high packet losses. Thus, this paper proposes a scalable architecture and its implementation for Distributed Packet Capturing (DiCAP) based on inexpensive off-the-shelf hardware running Linux operating system. The prototype designed has been tested as an implementation and was evaluated against other Linux capturing tools. The evaluation shows that DiCAP can perform loss-less IP packet header capture at highspeed packet ...

• Type: Conference
• Year: 2008
• Where: LCN
• Authors: Cristian Morariu, Burkhard Stiller
• Keywords: Computer Networks, IP Traffic, IP Traffic Measurements, LCN 2008, Traffic Measurements