Performance Analysis of Packet Capture Methods in a 10 Gbps Virtualized Environment

Abstract—Network speeds are increasing and processor core counts rise while processor clock rates stagnate. This has led to both packet processing applications distributing their workload over several cores and virtualization of physical systems also using multiple cores. However, these two concepts are at odds with each other as both must take full advantage of multi-core systems for desirable performance. In this paper, we look at the performance considerations of dealing with 10 Gbps traffic rates in worst case loads using a bare-metal system and a virtual appliance model and several difference packet capture methods. We also discuss potential ideas to improve the performance of these virtual systems. Index Terms—network monitoring; performance evaluation; throughput; virtualization I