What is Linuxflow?
The motivation of Linuxflow
How it work?
The typical traffic collection environment
Performance issues
Hardware recommendation
Paper and presentation
Obtain the code

What is Linuxflow?

Linuxflow is a passive network measurement facility, designed for using on high-speed links such as gigabit networks. It is a software solution based on Linux, providing both packet and flow level fine-grained traffic information, the idea behind which is derived from Libpcap, Cisco NetFlow, IETF RTFM etc.

The Motivation of Linuxflow

Passive network measurement is a crucial for network management. Many projects and systems depend on passive network measurement, such as NMS, IP Accounting and Billing system, IP Monitoring, user behavior analysis and network anomalies detection etc. In CERNET, historically, we have used several passive measurement techniques. The following figure presents the measurement methods by means of which CERNET can consume the increasingly large number of traffic packets at network gateway during 5 years until 2002, as well as their capabilities respectively.

In order to meet the increasing performance requirement for high-speed IP Accounting and Billing System and IP Monitoring Infrastructure for CERNET, we designed Linuxflow based on following consideration:

How it Work?

Basically, Linuxflow works the same way as TCPDUMP. You can set the network card in promiscuous mode and use Linuxflow to sniff the traffic. Linux includes:

The Typical Traffic Collection Environment

You can use several ways to setup sniffing environment for Linuxflow:

Detailed Approach

You can obtain more detailed information about Linuxflow through my Paper and Presentation on PAM2003.
See also the Paper and presentation section.

Performance Issues

In packet capture, the packets received by a NIC will transfer to the Linux kernel by the NIC driver, and transfer from kernel space to the user space flow aggregating daemon or other analysis applications by the capture protocol stack though socket. several factors will influence the performance in this chain.

First, we consider the hardware influence, because all packets need to enter the NIC and go through the PCI bus to NIC driver, the network bandwidth is limited by the NIC capability and the PCI bandwidth. For Gigabit or even high environment, the 64bits, 66Mhz or 64bits, 133Mhz PCI bus should be considered. Moreover, The PPS directly determines the CPU interrupt rate. For example, if every packet arriving on an 1 Gb/s NIC generates an I/O interrupt, then the system will get interrupted every 12 μs. Most PC systems are not able to keep up with this interrupt rate. A common technique to reduce CPU requirements and to increase throughput is called interrupt moderation, which bundles several packets into a single interrupt. Some NIC driver can set the value of how many packets can process in one interrupt or the RX buffer size. tuning these parameters may improve the capture performance. If NIC has enough capability, the more fast CPU can keep up with the higher PPS rate.

Furthermore, The software architecture needs to be optimized to reach the highest performance limited by hardware. The context switch between kernel space and user space is quite costly, We should filter as much as possible information in kernel, and only copy selected packet fields to user space. In addition, we should coalesce the records to decrease the number of time to copy information from kernel space to user space. Based on above consideration, we designed Linuxflow :)

Hardware Recommendation

Processor DualIntelXEON 2.0Ghz or higher
Memory 1GB or higher
Accessory 64bits, 66Mhz or 64bits, 133Mhz or higher
Main board Serverworks or Intel
NIC SysKonnect, Intel EEpro1000 XF etc.

Paper and Presentation

"Linuxflow: A High Speed Backbone Measurement Facility"
ZhiChun Li, Hui Zhang, Yue You, Tao He,
Passive and Active Measurement Workshop (PAM) 2003, La Jolla, California, USA, April, 2003.
(PDF 190KB) (Slides: PDF 375KB PPT 586KB )

Obtain the Code

Source code of Linuxflow packet filter for Linux kernel 2.4 and the Linuxflow flow aggregating daemon