A kind of packet capturing and mirror image flow forwarding method based on DPDK
Technical field
The present invention relates to security monitoring and flow analysis technical field, specifically a kind of packet capturing and mirror image stream based on DPDK
Retransmission method is measured, the method may make data packet to retain in systems for a long time without packet loss.
Background technique
In security monitoring, flow analysis application, need to analyze the data on flows packet of network egress, and with mutual
The development of networking technology, flow is increasing, and the flow of a network may reach 10,000,000 grades of pps, this is to data packet
It is a challenge for crawl.In addition it also usually needs to dispose different safety equipments largely based on mirror image flow, such as IPS, data
Library audit, abnormal flow, flow analysis etc., this requires more parts of traffic mirrorings, but mirror image flow port is on interchanger
It is limited.
About the crawl of data packet, there are two schemes at present: one is hardware plans, but hardware plan is expensive, no
Range etc is discussed in this patent.One is software scenarios, are such as based on operating system nucleus network protocol stack, such as pfring.
Scheme based on system kernel, by taking Linux as an example, program needs to do frequent switching and frequent friendship in User space and kernel state
Data are changed, cause performance poor, are unable to satisfy the demand of big flow.Another software scenario is using DPDK (Data Plane
Development Kit).DPDK is the data packet processing frame based on data surface of Intel Company's exploitation, its packet capturing driving
Work provides quickly transmitting-receiving packet interface in User space, for User space application program, and the quick crawl of data packet may be implemented.But
DPDK is very big to CPU Cache dependence, and DPDK is by the way that data packet buffer (mbuf) is buffered in CPU Cache come real
Now quick send and receive packets, and Cache size is limited, and generally with regard to 10-30M size, packet receiving buffer cannot thus be set greatly,
So grabbing after data packet handled from DPDK, need rapidly to return mbuf.This for simple data packet at
Ought to be with for (for example data packet forward class application), there is no problem.But for needing to carry out at complicated analysis data packet
For the application of reason, a data packet may retain 3 seconds or more time in systems, be not suitable for directly in DPDK thread context
In complicated analysis carried out to data packet handle, mbuf caching can be easily caused insufficient, in this way so as to cause under packet loss, performance
Drop.
For needing the scene of more parts of mirror image flows, the limited problem in mirror image flow port, is usually to pass through on interchanger
The optical splitter of profession is bought to solve, but the optical splitter of profession is expensive.DPDK can be used to solve in software scenario, develops
One DPDK shunts application, it is also desirable to be deployed on special server apparatus and no small cost.
Summary of the invention
Lead to packet loss when existing for packet snapping method in the prior art and carry out complicated applications processing and solves interchanger
The limited scheme in upper mirror image flow port technical problem at high cost, the invention discloses one kind to be based on
The packet capturing of DPDK and mirror image flow forwarding method.
Several technical terms are explained first.
PortX, portY: network interface card port.
Packet: data packet.
The object of mbuf:DPDK storing data packet, a mbuf deposit a data packet.
Memory buffer: the contiguous memory for the one piece of fixed size applied from big page memory pool.
Packets buffer: the buffer of the packet of self-defined structure is stored, memory reference is big page memory
The memory buffer in pond, a packets buffer object can deposit the data packet of multiple self-defined structures.
Buffer queue: the queue of storage Packets buffer.
Technical scheme is as follows:
The invention discloses a kind of packet capturing based on DPDK and mirror image flow forwarding methods, specifically include step below
It is rapid: Step 1: the packets buffer structure of the structure of the customized data packet grabbed and storing data packet;Step 2:
Initialization DPDK environment, creation memory, distribution CPU to DPDK packet receiving processing thread, initialization network card configuration and are configured
The number of queues of packets buffer, each packet receiving thread are responsible for collecting the data of different port or same port different queue
Packet;Step 3: packets buffer is submitted;The packets buffer submission specifically includes: using the send and receive packets of DPDK
After interface receives data packet from entrance network interface card port to, DPDK data packet mbuf is copied to the packets of user-defined format
In buffer, mbuf is then given back to DPDK;When packets buffer will be more than its memory headroom size, by this
Packets buffer is put into a buffer queue, completes the submission of a packets buffer at this time;Step 4: with
Packets buffer is taken out at family from buffer queue, and the packets buffer of each buffer queue is by user's line
Journey goes to read, and after user thread reads a packets buffer object, is analyzed and processed to data packet, has handled it
Afterwards, packets buffer is given back;The DPDK is the data packet processing frame based on data surface of Intel Company's exploitation;
The mbuf is the object of DPDK storing data packet, and a mbuf deposits a data packet;The memory buffer is from memory
The contiguous memory of one piece of fixed size of application;The packets buffer is the data packet for storing self-defined structure
Buffer, a packets buffer object deposit the data packet of multiple self-defined structures;The buffer queue is storage
The queue of Packets buffer.
Further, the above method further includes setting timer, when the timer is triggered, if current
Packets buffer is same that packets buffer is submitted to give buffer queue with the presence of data packet.
Further, the structure head of above-mentioned raw data packets includes customized extension header length and customized extension letter
Cease length, customized extension header and customized extension information in counter structure, the customized extension header and customized expansion
Information is opened up to be used to analyze use to upper layer application.
Further, above-mentioned steps two create in save as big page memory pool, the memory buffer is from big page memory
Chi Zhongshen memory, that the memory of packets buffer is quoted is the memory buffer of big page memory pool.
Further, the above method further includes working as to operate in nonuniform memory access NUMA environment, the wound of memory pool
It builds and allocation strategy is as follows: its NUMA node being obtained according to the CPU core where the operation of the DPDK packet receiving thread of configuration first, then
A memory pool is created for each NUMA node, the corresponding memory pool of NUMA node where then DPDK packet receiving thread selects oneself
To apply for memory buffer.
Further, the process of above-mentioned data packet forwarding specifically includes: checking forwarding table, sees the arrival end of the data packet
Mouth portX is either with or without corresponding outlet port, if there is corresponding outlet port portY, with regard to drawing for updated data package mbuf
With counting, and data packet mbuf is sent out by outlet port portY, then gives back mbuf to DPDK.If copied without forwarding
It gives back after shellfish, if there is forwarding, is given back after forwarding at once.
Further, above-mentioned big page memory pool is created using the rte_mempool_create function of DPDK, memory
It is incoming that the memory buffer number in pond, the memory buffer size of memory pool then pass through initialization function parameter.
Further, during above-mentioned initialization network card configuration, match for each network interface card port by DPDK driving adapter tube
Transmitting-receiving number of queues is set, and installs each transmitting-receiving queue.
Further, above-mentioned to pass through DPDK's by the network interface card port configuration transmitting-receiving number of queues of DPDK driving adapter tube to be each
Rte_eth_dev_configure function is realized, described to install each rte_eth_rx_ of the transmitting-receiving queue by DPDK
Queue_setup function is realized.
Further, above-mentioned packets buffer will be more than that its memory headroom size refers to current packets
After buffer adds data package size to be copied, it is filled in packets buffer.
By using above technical solution, the invention has the benefit that by DPDK data packet in packet receiving thread
Mbuf is copied out, and then gives back mbuf at once to DPDK, and data packet can be made to retain in systems for a long time in this way
The problem of packet loss will not being caused to influence performance because of mbuf caching deficiency.Data packet is converted into certainly in DPDK packet receiving thread
The data packet packet of definition format, such upper layer application can not have to directly do data packet again using data packet packet
Copy+conversion is also in this way a raising to performance.The data packet copied out is stored in big page memory to be made to upper layer application
With compared to common memory, the TLB miss rate of big page memory is low, there is faster access speed.Using can infinitely configure (as long as
Installed System Memory is sufficiently large) the big page memory pool of size does the caching of data packet, it must can utmostly extend data packet in this way
Cache-time, without influence packet loss.Packet receiving thread be all using the memory of local nonuniform memory access framework NUMA node,
Performance is more preferable.Mirror image flow is while the machine applied analysis, moreover it is possible to which by other network interface card ports, fast-forwarding is gone out.So not
Need to buy special optical splitter or the special data packet forwarding system of deployment again.
Detailed description of the invention
Fig. 1 is data flow model figure of the invention.
Fig. 2 is that packets buffer submits flow chart.
Specific embodiment
With reference to the accompanying drawings of the specification, the specific embodiment that the present invention will be described in detail.
The invention discloses a kind of packet capturing based on DPDK and mirror image flow forwarding methods, specifically include
1. structural body defines
The packet of self-defined structure first is defined as follows:
The tail portion of structural body is followed by packet content information, and the packet structure is in addition to storing raw data packets
Outside information, there are also customized extension header and customized two regions of extension information, and reserve the two spaces makes to upper layer application analysis
With.
PacketsBuffer structure is defined as follows:
The tail portion of structural body is followed by continuous PACKET content.
2. program initialization
During program initialization, initialization DPDK environment, creation big page memory pool, distribution core cpu resource are given
DPDK packet receiving processing thread initializes network card configuration and has configured packets buffer number of queues.
Wherein big page memory pool using 1G hugepages big page, (match in system kernel start-up parameter by the number of 1G big page
Set), it is created using the rte_mempool_create function of DPDK, the memory buffer number of memory pool and memory pool
Memory buffer size, it is incoming by initialization function parameter.If system operates in NUMA environment, the creation of memory pool and
Allocation strategy is as follows: their NUMA node is obtained according to the CPU cores where the operation of the DPDK packet receiving thread of configuration first,
Then a memory pool is created for each NUMA node, NUMA node where then DPDK packet receiving thread selects oneself is corresponding interior
Pond is deposited to apply for memory buffer, processor under NUMA architecture is made full use of to access local NUMA node memory speed faster in this way
The characteristics of.
Core cpu and DPDK packet receiving processing number of threads configure (such as-c coremask--nb- by start-up parameter
Cores=X), per thread is tied on independent CPU core and runs.Since there are more queue read functions in network interface card port, often
A thread is responsible for collecting the data packet of different port or same port different queue.
During initializing network card configuration, number of queues is received and dispatched for each network interface card port config. number by DPDK driving adapter tube
(passing through the rte_eth_dev_configure function of DPDK), and each transmitting-receiving queue is installed (by the rte_eth_ of DPDK
Rx_queue_setup function).
By being passed to initialization function parameter configuration packets buffer number of queues.
3.DPDK packet receiving processing
The process executes in DPDK packet receiving processing thread, has packets buffer to submit and forwards at two with data packet
Manage logic.Number is received from entrance network interface card port (Fig. 1 portX) using the transmitting-receiving packet interface rte_eth_rx_burst () of DPDK
After packet, in packets buffer that DPDK data packet mbuf is copied to a user-defined format, then give back mbuf to
DPDK (if without forwarding, gives back, if there is forwarding, give back after forwarding) at once after copy.When packets buffer will surpass
Cross its memory headroom size (after current packets buffer adds data package size to be copied, packets buffer
Inside it is filled with) when, which is put into a buffer queue (for example use the push of std::queue
Method), the submission of a packets buffer is completed at this time.A timer is arranged in programming system simultaneously, when timer quilt
When triggering, if current packets buffer equally can submit packets buffer to buffer with the presence of packet
Queue thus is avoided that the case where packets buffer for a long time can be just submitted when flow very little.Complete packets
Buffer submits process to see Fig. 2.Each DPDK packet receiving processing thread can submit packets to each buffer queue
Buffer, each packet receiving thread safeguard the queue index of oneself, replace queue index value by round robin mode, in turn
It is submitted in each buffer queue, so that the packets buffer number of each queue is balanced.
Data packet forwarding process: check that (port forwarding table configures forwarding table in/etc/dpdk/config file, in table
Establish entrance port with export port MAC Address mapping) see ingress port portX either with or without corresponding outlet port, such as
For fruit there are outlet port portY, the reference count with regard to updated data package mbuf (passes through the rte_pktmbuf_ of calling DPDK
Refcnt_update function), and data packet mbuf is sent out by outlet port portY.When there is data packet forwarding,
Mbuf is given back to DPDK after the completion of forwarding.
4. user reads packet, analysis processing
User reads packet procedures and goes to execute by one or more threads, and it is actually from packets buffer that user, which reads packet,
Packets buffer is taken out in queue, the packets buffer of each buffer queue is gone to read by a user thread
It takes.After user thread reads a packets buffer, data packet is analyzed and processed.It, will after having handled
Packets buffer is returned to big page memory pool.
The coefficient and parameter gone out given in the above embodiments, is available to those skilled in the art to realize or use
Invention, invention, which does not limit, only takes aforementioned disclosed numerical value, in the case where not departing from the thought of invention, the technology of this field
Personnel can make various modifications or adjustment to above-described embodiment, thus the protection scope invented is not by above-described embodiment institute
Limit, and should be the maximum magnitude for meeting the inventive features that claims are mentioned.