Friday, December 24, 2010

FreeBSD: High Performance Packet Capture

I'm not sure how many of you have heard about this project, however I found FreeBSD ringmap implementation when I was googling and it seems to be interesting to me, I suggest you visit the link and read up the documentation/presentation.

I'm going to try it out whenever possible, right now it is ported to FreeBSD 8.1 stable, you can actually download the source code and test it out yourself.

http://code.google.com/p/ringmap/

You can also find a lot of information about high performance packet capture from the link below as well, I usually use the setting that is recommended over there for my FreeBSD sensor setup.

http://www.net.t-labs.tu-berlin.de/research/hppc/

By the way, FreeBSD already has zero copy bpf implemented, thanks to Robert Watson for that since he has done a lot of background works on it. To know more about zero copy bpf you can check the presentation slide here -

http://www.watson.org/~robert/freebsd/2007asiabsdcon/20070309-devsummit-zerocopybpf.pdf

Cheers (;])

1 comment:

Anonymous said...

I'd be curious to see how this ringmap implementation compares to OpenBSD's current network stack, considering the improvements made to PF that address the issues ringmap states on the google project page. There is a nicely done PF presentation http://www.undeadly.org/cgi?action=article&sid=20110517075646
if you listen to the audio linked in the comments and flip through the (admittedly rather long but thorough and interesting) slides, you get a good idea of how their work has affected networking performance for the better. Cheers.