Efficient Continuous Latency Monitoring with eBPF

Sundberg, Simon; Brunström, Anna; Ferlin, Simone; Høiland-Jørgensen, Toke; Brouer, Jesper Dangaard

doi:10.1007/978-3-031-28486-1_9

Cited by 9 publications

(3 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In [23], eBPF was utilized for passive measurement of network latency to overcome the inefficiency of always-on passive monitoring to keep up with traffic as packet rates increase, especially on current multi-Gbps interfaces. The proposed eBPF-based solution that evolved Passive Ping (ePPing) delivered accurate RTT measurements and greatly improved on state-of-the-art software-based solutions, such as PPing, handling over 1 Mpps, or, correspondingly, more than 10 Gbps on a single core.…”

Section: A Sauron Ebpf Module For Transportmentioning

confidence: 99%

eBPF: A New Approach to Cloud-Native Observability, Networking and Security for Current (5G) and Future Mobile Networks (6G and Beyond)

Soldani,

Nahi,

Bour

et al. 2023

IEEE Access

View full text Add to dashboard Cite

Modern mobile communication networks and new service applications are deployed on cloudnative platforms. Kubernetes (K8s) is the de facto distributed operating system for container orchestration, and the extended version of the Berkeley Packet Filter (eBPF) -in the Linux (and MS Windows) kernel -is fundamentally changing the approach to cloud-native networking, security, and observability. In this paper, we introduce what eBPF is, its potential for Telco cloud, and review some of the most promising pricing and billing models applied to this revolutionary operating system (OS) technology. These models include schemes based on a data source usage model or the number of eBPF agents deployed on the network, linked to specific eBPF modules. These modules encompass network observability, runtime security, and power dissipation monitoring. Next, we present our eBPF platform, named Sauron in this work, and demonstrate how eBPF allows us to write custom code and dynamically load eBPF programs into the kernel. These programs enable us to estimate the energy consumption of cloud-native functions, derive performance counters and gauges for transport networks, 5G applications, and non-access stratum protocols. Additionally, we can detect and respond to unauthorized access to cloud-native resources in real-time using eBPF. Our experimental results demonstrate the technical feasibility of eBPF in achieving highly performant monitoring, observability, and security tooling for current mobile networks (5G, 5G Advanced) as well as future networks (6G and beyond).

show abstract

Section: A Sauron Ebpf Module For Transportmentioning

confidence: 99%

eBPF: A New Approach to Cloud-Native Observability, Networking and Security for Current (5G) and Future Mobile Networks (6G and Beyond)

Soldani,

Nahi,

Bour

et al. 2023

IEEE Access

View full text Add to dashboard Cite

show abstract

“…The underlying technology we utilize to enable efficient network monitoring is called eBPF 1 . The eBPF technology allows to safely and efficiently run custom programs inside the Linux 2 kernel.…”

Section: Ebpfmentioning

confidence: 99%

“…The Internet has been tremendously successful and is an important part of the modern society. Today around 5.4 billion people [1] are connected to the Internet, being a natural part of everyday life for many. As computers have evolved and become faster and more devices have been connected to the Internet, the amount of data sent over the Internet has drastically increased over time.…”

Section: Introductionmentioning

confidence: 99%

Towards Ubiquitous and Continuous Network Latency Monitoring

Sundberg

View full text Add to dashboard Cite

The Internet plays an important role in modern society, and its network performance impacts billions of users every day. For many network applications, network latency has a large impact on the quality of experience for the end user. Due to a lack of extensive network latency monitoring, the observability of network latency in real networks is often limited. This poses a problem for understanding network latency on the Internet today, and for assessing the impact various solutions that aim to reduce network latency have once they are deployed in the wild. This thesis addresses shortcomings with current solutions for monitoring network latency, in particular the performance of passive monitoring solutions on general-purpose commodity hardware, aiming to enable more ubiquitous latency monitoring and ultimately provide a comprehensive view of real-world network latency. We utilize the recently emerging eBPF technology to implement passive network latency monitoring inside the Linux kernel. Through experiments on a testbed, we show that our solution can monitor packets at over an order of magnitude higher rates than comparable previous solutions, allowing it to successfully monitor the latency for multi-gigabit traffic on general-purpose commodity hardware. Additionally, we demonstrate the feasibility of continuously monitoring network latency by deploying our solution inside an Internet Service Provider and monitoring the network latency for all customer traffic. Through an extensive analysis of the collected latency data, we show large differences in how network latency is distributed across different parts of the network.

show abstract