PFQ Kernel Module

Architecture

PFQ is a Linux Kernel module for packet capture and functional processing designed to be efficient on multi-core architectures.

PFQ works by registering itself as network sniffer (as PF_PACKET), or through accelerated drivers obtained by recompiling the source codes with pfq-omatic script.

The architecture, based on lock-free software algorithms, benefits from the following queues:

• per-core pre-fetch and batch queues, to increase the cache-friendness.
• lock-free SPSP queues, with reduced traffic of coherence between cores.
• lock-free MPSP queues, with amortized atomic operations.

Module parameters

filename:       /root/GitHub/PFQ/kernel/./pfq.ko
description:    Network Monitoring Framework for Multi-core Architectures
author:         Nicola Bonelli <nicola.bonelli@cnit.it>
license:        GPL
depends:        
vermagic:       3.13-1-amd64 SMP mod_unload modversions 
parm:           direct_capture: Direct capture packets: (0 default) (int)
parm:           capture_incoming: Capture incoming packets: (1 default) (int)
parm:           capture_outgoing: Capture outgoing packets: (0 default) (int)
parm:           capture_loopback: Capture loopback packets: (0 default) (int)
parm:           cap_len: Default capture length (bytes) (int)
parm:           max_len: Maximum transmission length (bytes) (int)
parm:           rx_queue_slots: Rx Queue slots (default=131072) (int)
parm:           tx_queue_slots: Tx Queue slots (default=131072) (int)
parm:           prefetch_len: Rx prefetch queue length (int)
parm:           batch_len: Tx batch queue length (int)
parm:           recycle_len: Recycle skb list (default=16384) (int)
parm:           flow_control: Flow control value (default=0) (int)
parm:           vl_untag: Enable vlan untagging (default=0) (int)

Performance

PFQ provides similar performance to those of PF_RING-DNA and Netmap, while maintaining the total flexibility of the software and the full compatibility with a plethora of device drivers.

Software acceleration is achieved by overloading certain kernel symbols at compile and replacing them with more efficient implementations. Additional information is available in the section pfq-omatic.

PFQ takes advantage from:

• a total lock-free architecture on the fast-data path.
• efficient queues handling with amortized atomic operations.
• reduced traffic of coherence among cores.
• ad-hoc socket buffer allocator.
• zero false-sharing.
• sparse counters.