Architecture of a Novel High Performance Traffic Capturing Device Based on the Intel IXP2400 Network Processor

The extensive availability of cost effective commodity PC hardware pushed the development of flexible and versatile traffic monitoring software such as protocol analyzers, protocol dissectors, traffic sniffers, traffic characterizers and IDSs (Intrusion Detection Systems). The largest part of these pieces of software is based on the well known libpcap API, which in the last few years has become a de facto standard for PC based packet capturing. Many improvements have been applied to this library but it still suffers from several performance flaws; these flaws are not generated by the software itself but by the underlying hardware bottlenecks. In this paper we present the architecture and the implementation design of a new traffic monitoring device, implemented by an Intel IXP2400 network processor PCI-X card connected to a gigabit ethernet LAN hosting a cluster of common personal computers running any libpcap based application. Since this is mainly an architectural work, only very preliminary experimental results are presented, while every design choice is justified from a theoretical point of view.