Commodity Packet Capture Engines: Tutorial, Cookbook and Applicability

Moreno, Víctor; Ramos, Javier; Río, Pedro M. Santiago del; García‐Dorado, José Luis; Gómez-Arribas, Francisco J.; Aracil, Javier

doi:10.1109/comst.2015.2424887

Cited by 45 publications

(32 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…In order to minimize CPU scheduling effects in the measurements, we fixed the affinity of iperf3 to a single CPU core in both the client and the server whenever it was possible-this optimization can be applied in multi-core systems, although the TP-Link Archer C7 AC 1750 featured only one core. Furthermore, these CPU cores were isolated at boot, as explained in [21]. Our commodity hardware only had a single Non-Uniform Access Memory (NUMA) node per device, but in complex machines, the selected CPU core should be that directly connected to the network interface card (NIC) [21].…”

Section: Methods Descriptionmentioning

confidence: 99%

On the Use of Affordable COTS Hardware for Network Measurements: Limits and Good Practices

Miravalls-Sierra¹,

Muelas²,

Vergara³

et al. 2018

Information

Self Cite

View full text Add to dashboard Cite

show abstract

Section: Methods Descriptionmentioning

confidence: 99%

On the Use of Affordable COTS Hardware for Network Measurements: Limits and Good Practices

Miravalls-Sierra¹,

Muelas²,

Vergara³

et al. 2018

Information

Self Cite

View full text Add to dashboard Cite

show abstract

“…Despite their processing flexibility, software based probes lack processing power to concurrently sustain high data rate traffic and normal processings [5]. To improve processing capabilities of network equipment, common solutions use specialized hardware implemented as ASICs.…”

Section: The Current Expansion Of Connected Objects and Computermentioning

confidence: 99%

“…However, these solutions have performance issues in terms of data rate. Moreno et al [5] showed that there is a boundary on smallest 64-byte packets processing. Despite fully optimized drivers, software tends toward the loss of packets when approaching 10 Gb/s, even with basic processing such as packets counting.…”

Section: Related Work a Software Probesmentioning

confidence: 99%

Open-source flexible packet parser for high data rate agile network probe

Cornevaux-Juignet

Arzel

Horrein

et al. 2017

2017 IEEE Conference on Communications and Network Security (CNS)

View full text Add to dashboard Cite

The development of a network centered life has increased overall data rates in core networks. Thus, data centers face the challenge to provide always more services at higher data rates while reacting quickly to complex failures and more powerful attacks thanks to efficient network forensics. Moreover, Software-Defined Networking (SDN) becomes a standard which offers agility but also requires forensic devices able to handle multiple configurations. Although conventional software probes are programmable and thus agile, they cannot support high data rate packet processing any more. Probes could benefit from Application Specific Integrated Circuits (ASIC) to cope with high data rates, but ASICs development time of many months makes them unable to satisfy agility requirements. With reconfiguration ability and high throughput processing without packet loss, Field Programmable Gate Arrays (FPGA) are the key technology chosen by some companies, such as Microsoft, Amazon and OVH, to be integrated into smart Network Interface Cards (NIC). Nevertheless, while high performance criteria is fulfilled, current FPGA probes benefit from an agility still limited to their conventional firmware upgrades which require proprietary tools and hardware-design time and knowledge. This paper proposes the first solution to offer FPGA probes with runtime agility thanks to a flexible packet parser which can be parameterized continuously by a software, endorsing complex tasks and SDN control. This allows a live adaptation of protocol processings from computer host alongside handling packets at line rate without data loss. The proposed parser is opensource and easily usable by network engineers through a Python software API. Benchmark results illustrate the performance of the agile high-level probe implemented on a NetFPGA SUME board, with XC7VX690T FPGA. 60 millions of 64-byte packets are counted based on features provided at runtime. These are selected by the software part, allowing the detection of different volumetric attacks within a few tens of microseconds. This represents a 40 Gb/s traffic of smallest Ethernet packets with no packet loss. With adequate boards, the generic design of the probe offers 160 Gb/s data rates and beyond on modern hardware, assuring probe scalability.

show abstract

“…Recently, high-speed network engines have been developed [12] to solve this issue. For instance a software traffic generator called PktGen-DPDK built on top of Intel's DPDK 1 framework has recently been released.…”

Section: Software-based Solutionsmentioning

confidence: 99%

Accurate and affordable packet-train testing systems for multi-gigabit-per-second networks

et al. 2016

Self Cite

View full text Add to dashboard Cite

Esta es la versión de autor del artículo publicado en: This is an author produced version of a paper published in: Multi-Gb/s links are becoming widespread, and network devices are under a continuous stress, so testing whether they guarantee the specified throughput or delay is a must. Software-based solutions, such as the packet-train traffic injection, were adequate for lower speeds, but they have turned inaccurate in the current scenario.Hardware-based solutions have proved to be very accurate, but usually at the expense of much higher development and acquisition costs. Fortunately, the new affordable FPGA SoC devices, as well as highlevel synthesis tools, can very efficiently reduce these costs. In this paper we show the advantages of hardware-based solutions in terms of accuracy, comparing the results obtained in an FPGA SoC development platform and in NetFPGA-10G to those of software. Results show that a hardware-based solution is significantly better, especially at 10 Gb/s. By leveraging high-level synthesis and open source platforms, prototypes were quickly developed. Noticeable advantages of our proposal are the high accuracy, the competitive cost with respect to the software counterpart, which runs in high-end off-the-shelf workstations, and the capability to easily evolve to upcoming 40 Gb/s and 100 Gb/s networks.

show abstract

Commodity Packet Capture Engines: Tutorial, Cookbook and Applicability

Cited by 45 publications

References 40 publications

On the Use of Affordable COTS Hardware for Network Measurements: Limits and Good Practices

On the Use of Affordable COTS Hardware for Network Measurements: Limits and Good Practices

Open-source flexible packet parser for high data rate agile network probe

Accurate and affordable packet-train testing systems for multi-gigabit-per-second networks

Contact Info

Product

Resources

About