Enabling packet fan-out in the libpcap library for parallel traffic processing

The large availability of multi-gigabit network cards for commodity PCs requires network applications to potentially cope with high volumes of traffic. However, computation intensive operations may not catch up with high traffic rates and need to be run in parallel over multiple processing cores. As of today, the vast majority of network applications are still based on the use of the pcap library interface which, unfortunately, does not provide a native multi-core support, even though the underlying capture technologies do. This paper introduces a novel version of the pcap library for the Linux operating-system that allows application level parallelism. The new library natively supports fanout operations for both multi-threaded and multi-process applications, by means of extended API as well as by a declarative grammar configuration suitable for legacy applications. In addition, the library can transparently run on top of the standard Linux socket and other accelerated capture engines. Performance evaluation has been carried out on a multi-core architecture in pure capture tests and in more realistic use cases involving monitoring applications such as Tstat and Bro, with standard Linux socket and the PFQ accelerated engine.