Packet capturing on parallel architectures

Nowadays commodity hardware is offering an ever increasing degree of parallelism: CPUs are equipped with more and more cores and a new generation of NICs can dispatch packets across multiple queues. Software based network monitoring can leverage the opportunity offered by this new trend in order to target a level of performance which was unattainable with single core technologies. In this paper, which is the result of a thorough measurement campaign, we explore the potential of parallelism when coupled with existing packet capturing technologies and show how, by accurately tuning configurations, a huge performance gain can be obtained. We also show how minimal configuration changes can dramatically affect the overall throughput.