Sharing a network adapter among multiple applications is not always a perfect solution. This is because an application or a kernel component needs to share packets among various applications coming from a single input pipe (the network adapter). This "packet arbitrator" component has several drawbacks including:
- Increasing packet capture latency resulting in imprecise timestamps.
- Reducing the overall capture performance as the arbitrator grabs several CPU cycles for each incoming packet.
- Capture performance reduces as the size of captured packets increases.
- Unless packet copy is used, the slowest capture application affects the performance of the fastest capture application and viceversa.
In other words, the arbitrator enables multiple applications to share the same network adapter, with the drawback of reduced overall performance. In some scenarios (e.g. on 10 Gbit networks or whenever it is necessary to capture full packets at high speeds), it makes sense to let an application to exclusively use a network adapter in order to remove all the components that are in the path from the adapter to packet capture application.
The straight packet capture component provides a direct path for incoming packets that completely removes any kernel/main CPU interaction for obtaining extreme packet capture speeds. Using this tecnology, the only limits to packet capture performance are the:
- PCI bus
- ASIC chip on the Ethernet card
- Packet capture application performance and design
The straight packet capture component is part of the accelerated driver, and it is accessed transparently via the enhanced libpcap.
| 