High performance packet capture on multi-core platform

In order to improve the efficiency of packet capture processes, this paper proposes a new zero-copy algorithm (PF_DMA) which can significantly reduce modifications to NIC drivers after implemented in the operating system kernel functions, and is portable between heterogeneous network platforms. Additionally, PF_DMA optimizes its algorithm for multi-core processors. By combining new techniques of modern NICs, PF_DMA realizes parallel packet captures through multiple receive queues, and improves the efficiency of packet captures. Experimental results indicate that PF_DMA can capture packets of 64 Byte at 2 Gbit wire-rate, and surpasses the performance of traditional zero-copy algorithms.