Performance Analysis of Packet Sniffing Techniques Applied to Network Monitoring

Network monitoring based on packet sniffing is one of the most useful techniques applied by system administrators and security analysts in order to identify threats within a local network. Despite being supposedly a simple task, it could sometimes be a highly resource consuming process. In this paper, the use of two sniffing techniques, raw sockets and scapy, to achieve better performance in terms of maximum capture packet rate are analyzed and compared. Furthermore, both techniques are optimized by using BSD Packet Filtering to improve packet capture, and a multicore architecture in order to reduce the exposition to denegation of service attacks. Finally, a system based on those techniques that is able to automatically detect layers 2 and 3 common vulnerabilities and attacks within the scope of corporative networks is developed. The result is an enhanced system focused on link and network layers that can be deployed in corporative environments.