High-Speed Packet Capture Mechanism Based on Zero-Copy in Linux

The development of gigabit-network demand higher standard of the packet capture´s efficiency. Traditional network packet capture mechanisms get poor performance when used in gigabit-network. So we proposed a new network packet capture mechanism using zero-copy and POLLING. Through the modification to the bottom-layer, we achieve the packet capture in user space, and bypass the intervention of operating system´s kernel. The efficiency of data processing is improved .We achieve wire-speed capture rate, and the CPU usage rate is below 10%.