PFQ Kernel Module
PFQ is a Linux Kernel module for packet capture and in-kernel functional processing designed to be efficient on multi-core architectures.
PFQ works by registering itself as a network sniffer (as PF_PACKET), or through accelerated drivers obtained by recompiling the source codes by pfq-omatic script.
filename: /opt/PFQ/kernel/./pfq.ko
description: Network Monitoring Framework for Multi-core Architectures
author: Nicola Bonelli <nicola@pfq.io>
license: GPL
depends: crc16
vermagic: 3.16-2-amd64 SMP mod_unload modversions
parm: direct_capture: Direct capture packets: (0 default) (int)
parm: capture_incoming: Capture incoming packets: (1 default) (int)
parm: capture_outgoing: Capture outgoing packets: (0 default) (int)
parm: cap_len: Default capture length (bytes) (int)
parm: max_len: Maximum transmission length (bytes) (int)
parm: rx_queue_slots: Rx Queue slots (default=131072) (int)
parm: tx_queue_slots: Tx Queue slots (default=131072) (int)
parm: prefetch_len: Rx pre-fetch queue length (int)
parm: batch_len: Tx batch queue length (int)
parm: recycle_len: Recycle skb list (default=4096) (int)
parm: vl_untag: Enable vlan untagging (default=0) (int)
PFQ provides similar performance to that of PF_RING-DNA and Netmap, while maintaining the total flexibility of the software and the full compatibility with a plethora of network device drivers.
The software acceleration is achieved by overloading certain kernel symbols at compile with more efficient implementations. Additional information is available in the section pfq-omatic.
PFQ takes advantage from:
- A total lock-free architecture on the fast-data path.
- Efficient queues implementations with amortized atomic operations.
- Reduced traffic of coherence among cores.
- Ad-hoc socket buffer memory allocator.
- Lightweight sparse counters.
- No false-sharing.