Improving the Performance of Passive Network Monitoring Applications using Locality Buffering

—In this paper, we present a novel approach for improving the performance of a large class of CPU and memory intensive passive network monitoring applications, such as intrusion detection systems, traffic characterization applications, and NetFlow export probes. Our approach, called locality buffering, reorders the captured packets by clustering packets with the same destination port, before they are delivered to the monitoring application, resulting to improved code and data locality, and consequently to an overall increase in the packet processing throughput and to a decrease in the packet loss rate. We have implemented locality buffering within the widely used libpcap packet capturing library, which allows existing monitoring applications to transparently benefit from the reordered packet stream without the need to change application code. Our experimental evaluation shows that locality buffering improves significantly the performance of popular applications, such as the Snort ...

• Type: Conference
• Year: 2007
• Where: MASCOTS
• Authors: Antonis Papadogiannakis, Demetres Antoniades, Michalis Polychronakis, Evangelos P. Markatos
• Keywords: MASCOTS 2007, Modeling And Simulation, Monitoring Applications, Packet Loss Rate, Packet Processing