The Research Of Traffic Measurement Methods Based On Multi-core Platform

With the continuous expansion and diversification of network scale, monitoringand operational management in network performance becomes more complex, whichplays an important role in network management, planning and development. Networktraffic measurement is the basis of research in network behavior. With the rapiddevelopment of computer technology, high performance and parallelism bringsmulti-core technology more chances and opportunities in the network trafficmeasurement.Existing methods of software-based traffic measurement are designed forordinary single-core PC, which don’t fully take into account the advantage of theparallelism of multi-core processors, especially packet processing stage in the innernetwork layer. For the research of network traffic measurement methods based onmulti-core processor platform, the main works are as follows:First. analyze the structure and properties of the classic packet capture methodsbased on Libpcap, Libpcap-mmap, PF_RING+NAPI, PF_RING+TNAPI, PF_RING+DNA. By precise and abundant experiments, evaluated and analyzed the ability ofpacket capture, CPU utilization, CPU load balancing of the packet capture methods onmulti-core platform. also compared the performance difference of these packetcapture methods on single-core and multi-core PC, analyzed the utilization ofparallelism for multi-core processor.Second. For packet capture method PF_RING used load balancing strategy RSScan not achieve a good load balancing between the processor core on multi-coreplatform, load balance method is used based on combination FD and RSS. The basicidea of this method is use the captured packet to match5-tuple filter firstly, thepackets can not be re-classified matches flow director filter, finally matches with RSS.Through experimental tests show that the packet capture method PF_RING uses theFD+RSS load balancing strategy has improved the packet capture capability and loadbalancing than uses the RSS strategy.Third. For the pipeline structure of packet processing with network monitoringapplications on multi-core processor platform, proposed a tree architecture modelparallel for Snort application. The theory of this model using pipelining andflow-pinning technology to design a processor dedicated to capture packets, the other processor is responsible for parallel processing of other stages. By experimentscompared and analyzed show that the secondary cache hit rate and throughputperformance of Snort applications can be improved with the tree-based parallelarchitecture model than parallel-based parallel architecture model.