Since high-speed network traffic can not be effectively coped with the network traffic capture system implemented by software, and the multiple network flow need to be collected simultaneously to improve the capturing efficiency, an high-speed network flow capture framework in combination of hardware and software was presented, and the implementation of network traffic capture system based on NetFPGA-10G, called HSNTCS, was discussed. A variety of network flow in hardware was filtered and classified by the exact string matching engine and the regular expression matching engine of this system. After being transmitted to the corresponding data buffer at the driver layer, the network flow was directly copied to the corresponding database in user space. The experiments show that the throughput of UDP (User Datagram Protocol）and TCP (Transmission Control Protocol）in the high-speed network traffic capture system implemented by the hardware under the condition of exact string matching achieved 1.2Gb/s, which is about 3 times of that implemented by the software; and the throughput of UDP and TCP in the system implemented by the hardware under the condition of regular expression matching achieved 640Mb/s, which is about 3 times of that implemented by the software. The results demonstrate that the capture performance by the method of hardware is better than the method of software.

The advantages of hardware-based regular expressions matching were analyzed. At the same time, the basic ideas and methodology for Field Programmable Gate Array (FPGA)-based regular expressions matching were introduced. Furthermore, an algorithm classification approach was proposed in terms of two technical indicators: matching speed and resource utilization. The advantages, disadvantages and the basic ideas of various algorithms were summarized. Finally, the key techniques, difficulties and the future direction in this field were discussed.