PFQ Kernel Module

Architecture

PFQ is a Linux Kernel module for packet capture and functional processing, designed to be efficient on multi-core architectures.

PFQ is able to capture registering as a network sniffer (as PF_PACKET), or directly from accelerated drivers obtained by simply recompiling the source codes though the pfq-omatic script.

It's architectures takes advantage of different queues:

• per-core prefetch queues to amortize atomic operations.
• per-core batch queues to increase the cache-friendness.
• lock-free SPSP queues, with reduced traffic of choerence between cores.
• lock-free MPSP queues, with amortized atomic operations.

Module parameters

filename:       /root/GitHub/PFQ/kernel/./pfq.ko
description:    Network Monitoring Framework for Multi-core Architectures
author:         Nicola Bonelli <nicola.bonelli@cnit.it>
license:        GPL
depends:        
vermagic:       3.13-1-amd64 SMP mod_unload modversions 
parm:           direct_capture: Direct capture packets: (0 default) (int)
parm:           capture_incoming: Capture incoming packets: (1 default) (int)
parm:           capture_outgoing: Capture outgoing packets: (0 default) (int)
parm:           capture_loopback: Capture lookback packets: (0 default) (int)
parm:           cap_len: Default capture length (bytes) (int)
parm:           max_len: Maximum transmission length (bytes) (int)
parm:           rx_queue_slots: Rx Queue slots (default=131072) (int)
parm:           tx_queue_slots: Tx Queue slots (default=131072) (int)
parm:           prefetch_len: Rx prefetch queue length (int)
parm:           batch_len: Tx batch queue length (int)
parm:           recycle_len: Recycle skb list (default=16384) (int)
parm:           flow_control: Flow control value (default=0) (int)
parm:           vl_untag: Enable vlan untagging (default=0) (int)

Performance

PFQ provides simlar performance to those of PF_RING-DNA and Netmap, while maintaining the total flexibility of the software and being full compatibility with a plethora of device drivers.

Software acceleration is done by overloading certain kernel symbols at compile time and providing more efficient implementations. PFQ takes advandage of:

• a total lock-free architecture on the fast-data path.
• efficient queues, with amortized atomic operations.
• reduced traffic of choerence amongs cores.
• cache-line aligned sparse counters.