Brief description of network packet capture technology based on zero copy

The so-called zero copy means that there will be no inter-memory copy during the packet sending and receiving process of a node. When the packet is sent, the user buffer of the application will directly go through the network interface to reach the external network, when receiving, the network interface directly sends data packets to the user buffer. This is "true zero copy )".

1. As shown in the zero copy workflow, the upper part of the image is the traditional packet capture module, and the lower part is the packet capture module using the zero copy technology. The zero copy technology enables a shared memory for the network adapter and the user zone through the operating system. The data received by the network adapter is written into the shared memory, the receiving ring and sending ring exist in this memory area. The receiving ring stores the data received from the NIC, And the sending ring stores the user data to be sent through the NIC. Because the memory is shared by the nic and the user zone, the user program can directly access and operate the data as long as the NIC receives the data. Similarly, as long as the user area program has network data to send, it can be directly sent by the NIC program. This reduces unnecessary system data calls, reduces interruptions, and enables the CPU to have more time to handle other tasks.

With high performance, the Libpcap packet capture module is compared with the zero copy technology. The following table shows the performance comparison diagram. The network adapter is an Intel 845 gigabit optical fiber network card.

Packages are more than five times the traditional libpcap system. This technology greatly improves the system's data processing capability, so that the CPU can have more valuable time to process other advanced applications.