A Control Plane Enabling Automated and Fully Adaptive Network Traffic Monitoring With eBPF

Abstract

The extended Berkeley Packet Filter (eBPF) enables the dynamic injection of user-defined processing logic at run-time in the Linux networking stack without disrupting any active monitoring process. This enables the selective extraction of only the traffic features that are needed in a given instant of time, which is what we define fully adaptive network traffic monitoring. However, eBPF programs require adhoc control plane routines for each specific scenario in order to orchestrate the underlying data plane and export the required metrics, resulting in potentially duplicated source codes to maintain, and creating the risk of deploying, at runtime, unverified user-defined code that controls the devices running the monitoring process. This paper presents a control plane that automatically adapts both its management tasks and data extraction methodologies based on the underlying data plane provided by the user, who can merely focus on the monitoring logic definition. The paper evaluates the performance of the control plane's modules and demonstrates the advantages, in terms of processing speed and memory consumption, of a fullyadaptive monitoring approach with respect to nProbe (a state-of-the-art solution), an adaptive and a nonadaptive methodology in eBPF. Experiments prove that the control plane monitoring functionalities do not significantly affect the underlying data plane (0.15% degraded throughput) and leverage the most efficient extraction primitives (20x faster execution time), and show that the fully-adaptive monitoring leads to a higher number of processed packets (10x) and significantly lower memory occupancy (10x) when extracting the smallest set of features.

eBPF: A New Approach to Cloud-Native Observability, Networking and Security for Current (5G) and Future Mobile Networks (6G and Beyond)

“…In short, our eBPF solution complements and expands the scope of the works published in [27] and [28] to modern Telco infrastructures running on cloud-native platforms. Our focus is on the application of the eBPF technology, for observability/monitoring, security, and energy, specifically to the latest generation of mobile communication networks deployed on In the high-level logical diagram illustrated in Figure 16, the daemonset (ds) agent, i.e., the Sauron Agent, is deployed on each node in the cluster.…”

“…Furthermore, the ideas presented in this paper meet the requirement for fully adaptive and programmable network monitoring. Drawing from similar approaches as described in [28], we propose a highly programmable eBPF solution that allows for efficient, dynamic, and granular monitoring pipelines (i.e., data collection mechanisms) with minimal overhead or impact for Telco networks.…”

Efficient traffic monitoring on SmartNICs through XDP co-design

“…It is used to safely and efficiently extend the capabilities of the kernel without requiring to change kernel source code or load kernel modules [9]. Nowadays witnesses the widespread use of eBPF technology in networking [2,[10][11][12][13], observability [14][15][16][17][18], security, etc., due to its security, flexibility, and low overhead. XDP (eXpress Data Path) is a kind of eBPF program, which enables high-performance programmable access to networking packets before they enter the networking stack.…”