PF_RING ZC
Zero-Copy RX/TX Packet Processing at 100+ Gbit
line rate
copy
entry price
The recommendation
Who should choose PF_RING ZC
PF_RING ZC (Zero Copy) is for developers and operators who need packet RX and TX at 100+ Gbit line rate at any packet size. Choose it when kernel overhead is the bottleneck or when packets must pass between threads, applications or VMs without copies.
- You need line rate capture or transmission on Intel, NVIDIA (Mellanox), Napatech or Silicom FPGA adapters.
- You build pipelines, load balancers or fan-out of the same traffic to several applications.
- You capture inside KVM virtual machines.
The ideal use case
Ideal use case for PF_RING ZC
- Environment: x86 64-bit (Intel and AMD) hosts, physical or KVM virtual machines.
- Team: developers using the C API, and ops using ready tools such as zbalance_ipc.
- Technical requirements: a supported adapter. Hardware filtering and nanosecond timestamps depend on the adapter.
- Problem solved: zero-copy load balancing, fan-out and kernel bypass, while selected packets can still go to the Linux IP stack.
Ideal for Every Environment
Deployment scenarios
Custom Zero-Copy Load-Balancing
PF_RING ZC comes with a simple API able to create a complex application in a few lines of code. PF_RING includes a sample application zbalance_ipc implementing load-balancing using this API.
The following example shows how to create an aggregator + balancer application in 6 lines of code.
Zero-Copy Traffic Fan-Out
PF_RING ZC can perform zero copy operations across threads, applications and VMs. It is possible to balance in zero-copy packets across applications or implement packet fanout, which is merely sending the same packet (by reference) to multiple consumer applications, all in zero-copy, at line rate.
Zero Copy Operations to Virtual Machines
PF_RING ZC allows you to forward (both RX and TX) packets in zero-copy to KVM Virtual Machines without using techniques such as PCIe passthrough. Thanks to the dynamic creation of ZC devices on VMs, you can capture and send traffic in zero-copy from VMs without having to patch the KVM hypervisor code, or start KVM after your ZC devices have been created. In essence it is possible to capture traffic at line rate on KVM VMs using the same command you would use on a physical host, without changing a single line of code.
Implement Zero-Copy Processing on Non Zero-Copy Devices
In PF_RING ZC you can use the zero-copy framework even with non-PF_RING aware drivers. This means that you can dispatch, process, originate, and inject packets into the zero-copy framework even though they have not been originated from ZC devices.
Once the packet has been copied (one-copy) to the ZC world, from then onwards the packet will always be processed in zero-copy during all his lifetime. For instance the zbalance_ipc demo application can read packet in 1-copy mode from a non-PF_RING aware device (e.g. a WiFI-device or a Broadcom NIC) and send them inside ZC for performing zero-copy operations with them.
Kernel Bypass and IP Stack Packet Injection
Contrary to other kernel-bypass technologies, with PF_RING ZC you can decide at any time what packets received in kernel-bypass you want to inject into the standard Linux IP stack. PF_RING comes with an IP stack packet injection module called stack that allows you to select what packets received in kernel-bypass need to be injected to the standard IP stack. All you need to do is to open the device “stack:eth1” and send your packets for pushing them to the IP stack as if they were received from eth1.
The alternatives
PF_RING ZC alternatives, compared
Same criteria for each option: role, when to choose it, limits and cost.
PF_RING
- Role: Open source framework, kernel-based capture.
- Choose it when: Multi-gigabit speed is enough and you do not want a license.
- Limits: No zero-copy line rate at 100 Gbit.
- Cost: Free
PF_RING FT
- Role: Flow processing on top of capture.
- Choose it when: You need flows and Layer-7 classification.
- Limits: Licensed, adds flows, not a replacement for ZC.
- Cost: 199.95 euro
The tradeoffs
When PF_RING ZC is not the right choice
- It is licensed per adapter family: Intel 1 Gbit 49.95 euro, Intel/NVIDIA 10-100 Gbit 149.95 euro, Napatech/Silicom FPGA 249.95 euro.
- x86 64-bit only.
- It is a programming framework: using it directly means writing code against the C API.
The proof
Specifications, versions, pricing and documentation
Features, supported platforms and protocols, editions with prices, documentation links and answers to common questions follow below.
at a glance
Key Features
- User-space zero-copy drivers for extreme packet capture/transmission speed as the NIC NPU (Network Process Unit) is pushing packets to the application without any kernel intervention
- Send and receive packets up to 100 Gbit wire-speed any packet size
- Library for distributing packets in zero-copy across threads, applications, Virtual Machines
- Zero-copy support for all Intel adapters, NVIDIA (Mellanox) ConnectX and BlueField, Napatech, Silicom FPGA (Fiberblaze)
- Flexible zero-copy packet processing API to implement pipelines, map-reduce and many other processing pattern
- Hardware-based packet filtering on (selected) commodity adapters including Intel, NVIDIA and FPGA adapters
- nBPF support to convert human-readabel BPF-like filters into hardware filters
- Hardware timestamps with nanosecond precision (selected adapters)
Specifications
Tech Specs
- Linux
- C API
x86 64-bit platforms are supported (Intel and AMD)
- Ethernet
- IPv4/IPv6
- TCP/UDP/ICMP/Any
- GTP/GRE/MPLS/VXLAN/PPP
models
Choose Your Model
Did you already install the software?
Select the model. Different models unlock different adapters and capacity. Check the comparison table.
Intel 1 Gbit
- Supported Intel families: igb
- Hardware timestamps (on selected models)
- Link Speed: 1 Gbit
Intel/NVIDIA 10-100 Gbit
- Supported Intel families: ixgbe, i40e, ice
- Supported NVIDIA/Mellanox models: ConnectX 5/6
- Hardware timestamps (on selected models)
- Hardware filters (on selected models)
- Link Speed: 10-100 Gbit
Napatech/Silicom FPGA
- Supported adapters: Napatech, Silicom/Fiberblaze
- Hardware filtering
- Hardware timestamps (nanoseconds)
- PCAP segment mode
- Flow offload (on Napatech)
- Link Speed: 10-100 Gbit
Related
Keep exploring
Pricing and editions
Compare editions and ways to buy.
Solutions
By use case and industry.
User guide
Installation and configuration.
Get started
Ready to see it on your network?
Download the free Community edition of ntopng, compare editions and buy in the shop, or talk to the ntop team about your requirements.
