It’s been a while since I posted the last update about clj-net-pcap. Before the work on my PhD thesis started to occupy most of my time, I actually put some more effort into further optimizing and improving clj-net-pcap. However, due to my PhD thesis, I didn’t write about this progress earlier.

In this post, I briefly summarize the work and progress that had been done. In the following, an overview of the new improvements and optimizations is given:

• Optimized raw data acquisition performance (by a factor of about 5.9)
• Alternative method for extracting information from raw packet data (performance improvement by a factor of about 2.5)
• Domain Specific Language (DSL) for dynamically configuring the data extraction
• Prototype of a self-adaptive mechanism for adjusting the DSL-based data extraction depending on performance constraints
• Functionality to write extracted data to files and named-pipes (fifos)
• Multiple output formats (CSV, JSON, ARFF)

The first four of these improvements were also published in the paper: “Improving Network Traffic Acquisition and Processing with the Java Virtual Machine,” Ruediger Gad, Martin Kappes, and Inmaculada Medina-Bulo, 20th IEEE Symposium on Computers and Communications (ISCC), in press. The paper also contains an evaluation of these improvements. The exact versions of clj-net-pcap that were used for the work presented in this paper are marked with corresponding tags.

The performance optimizations of the raw data acquisition performance were done by improving the forwarding of raw packet data from the native libpcap-based parts to the parts inside the JVM. These optimizations include patches in the corresponding JNI-related C and Java code of jNetPcap that is used for interconnecting the native and JVM-based parts. These patches are released under the same license as jNetPcap and are available in the clj-net-pcap repository.

Before the new release will be published, there is still some housekeeping that has to be done. However, the new functionalities can already be used now.