High speed packet capture

• US 20070036156A1
• Filed: 08/12/2005
• Published: 02/15/2007
• Est. Priority Date: 08/12/2005
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Deninger, William, Broeker, Stephen, Liu, Weimin, Lowe, Rick, Iglesia, Erik
• Granted Patent: US 7,907,608 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: G06F 12/00 Accessing, addressing or allocating within memory systems or architectures digital input from, or digital output to record carriers, e.g. to disk storage units, G06F3/06
• CPC Class Codes: H04L 1/0083 Formatting with frames or packets; Protocol or part of protocol for error control
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 69/12 Protocol engines
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Packets can be read from a network interface into an application using a single kernel copy. In one embodiment, the invention includes a receiver packet memory to store captured packets, and a network interface driver operating in a kernel of a device to read packets captured by network interface hardware into the kernel by storing captured packets in the receiver packet memory. Then, an application interface can expose the receiver packet memory to an application executing on the device by representing the receiver packet memory as a virtual file.

Claims

1. A method for reading data into an application, the method comprising:

reading a packet of data captured by a network interface by a network interface driver;

storing the packet in a receiver packet memory;

updating a head indicator, the head indicator identifying the last new packet in the receiver packet memory; and

representing the receiver packet memory as a virtual file.

2. The method of claim 1, further comprising memory mapping the virtual file by an application.

3. The method of claim 2, further comprising reading new packets from the memory-mapped virtual file by an application.

4. The method of claim 3, wherein reading the new packets comprises reading the new packets from a memory location indicated by a tail indicator, the tail indicator identifying the last packet read by the application.

5. The method of claim 4, wherein reading the new packets comprises reading the new packets from memory locations between the tail indicator and the head indicator.

6. The method of claim 4, further comprising updating the tail indicator to account for the new packets read by the application.

7. The method of claim 4, wherein the head indicator comprises a head pointer into the receiver packet memory and the tail indicator comprises a tail pointer into the receiver packet memory.

8. A capture device comprising:

a receiver packet memory to store captured packets;

a network interface driver operating in a kernel of the capture device to read packets captured by network interface hardware into the kernel by storing captured packets in the receiver packet memory; and

an application interface configured to expose the receiver packet memory to an application executing on the capture device by representing the receiver packet memory as a virtual file.

9. The capture device of claim 8, wherein the application accesses the receiver packet memory by memory mapping the virtual file.

10. The capture device of claim 9, further comprising a control memory containing a head indicator and a tail indicator.

11. The capture device of claim 10, wherein the head indicator comprises a head pointer pointing to the last packet written to the receiver packet memory by the network interface driver, and the tail indicator comprises a tail pointer pointing to the last packet processed by the application.

12. The capture device of claim 11, wherein the application migrates packets from the kernel to the application by performing memory read operations on the memory-mapped virtual file.

13. The capture device of claim 12, wherein the application performs read operations by reading packets between the head pointer and the tail pointer.

14. The capture device of claim 13, wherein the application updates the tail pointer after each packet migration.

15. The capture device of claim 8, wherein the network interface hardware comprise a network interface controller (NIC).

16. A machine-readable medium having stored thereon data representing instructions that, when executed by a processor running an operating system kernel and at least one application, cause the processor to perform operations comprising:

reading a packet of data captured by a network interface by a network interface driver;

storing the packet in a receiver packet memory;

updating a head indicator, the head indicator identifying the last new packet in the receiver packet memory; and

exposing the receiver packet memory to the application by representing the receiver packet memory as a virtual file.

17. The machine-readable medium of claim 16, wherein the instructions further cause the processor to migrate the receiver packet memory into the application by memory mapping the virtual file.

18. The machine-readable medium of claim 17, wherein the instructions further cause the processor have the application to read new packets from the memory-mapped virtual file.

19. The machine-readable medium of claim 18, wherein reading the new packets comprises reading the new packets from a memory location indicated by a tail indicator, the tail indicator identifying the last packet read by the application.

20. The machine-readable medium of claim 19, wherein reading the new packets comprises reading the new packets from memory locations between the tail indicator and the head indicator.

21. The machine-readable medium of claim 19, wherein the instruction further cause the processor to have the application update the tail indicator to account for the new packets read by the application.