search

david415 / HoneyBadger

Quantum Insert detector/recorder
GNU General Public License v3.0
305 stars 39 forks source link

use a page cache for reassembled TCP segments in ring buffer #3

Closed david415 closed 9 years ago

david415 commented 9 years ago

HoneyBadger's ring buffer is used for TCP segment overlap comparison (injection detection)... and we should use a page cache to avoid memory allocation.

gopacket.tcpassembly has some excellent software design that we can learn from... including a page cache... tcpassembly uses it for the out of order packets: " Packet data for out-of-order packets is copied into reusable pages, and new pages are only allocated rarely when the page cache runs out. Page caches are Assembler-specific, thus not used concurrently and requiring no locking. "

david415 commented 9 years ago

We must determine weather we are using the ring buffer correctly to avoid new memory allocations. You'd think there wouldn't be additional memory allocations upon ring buffer element assignment... because we pass the value not the pointer... however the value is a Reassembly object which contains a byte slice.. so does that mean new memory allocation or not?