Exploiting Commodity Multicore Systems for Network Traffic Analysis

Luca Deri
ntop, Pisa, Italy, Email: deri@ntop.org
Francesco Fusco
IBM Zurich Research Laboratory, Rüschlikon, Switzerland, Email: ffu@zurich.ibm.com

Abstract—The current trend in computer processors is towards multicore systems. Although operating systems have been adapted long time ago to support multi-processing, kernel
network layers have not yet taken advantage of this new technology. The result is that packet capture, the cornerstone of every network monitoring application, is not efficient on modern
system and its performance gets worse with the number of cores.

This paper describes common pitfalls of network monitoring applications when used with multicore systems, and presents solutions to these problems. In addition, it covers the design and implementation of a new multicore-aware packet capture kernel module that enables monitoring applications to scale with the number of cores, contrary to what happens in most operating systems.

Keywords: Passive packet capture, multicore processors, traffic monitoring, Linux kernel.