Wire-Speed Hardware-Assisted Traffic Filtering with Mainstream Network Adapters

Deri, Luca; Gasparakis, Joseph; Waskiewicz, Peter; Fusco, Francesco

doi:10.1007/978-1-4419-7753-3_5

Cited by 9 publications

(16 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…By splitting a single RX queue into several smaller queues, the load, both in terms of packets and interrupts, can be balanced across cores to improve the overall performance. Modern interface cards (NICs) support static or even dynamically configurable [13] balancing policies. The number of available queues depends on the NIC chipset, and it is limited by the number of available system cores.…”

Section: Motivation and Scope Of Workmentioning

confidence: 99%

High speed network traffic analysis with commodity multi-core systems

Fusco

Deri²

2010

Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement

Self Cite

132

View full text Add to dashboard Cite

Multi-core systems are the current dominant trend in computer processors. However, kernel network layers often do not fully exploit multi-core architectures. This is due to issues such as legacy code, resource competition of the RXqueues in network interfaces, as well as unnecessary memory copies between the OS layers. The result is that packet capture, the core operation in every network monitoring application, may even experience performance penalties when adapted to multi-core architectures. This work presents common pitfalls of network monitoring applications when used with multi-core systems, and presents solutions to these issues. We describe the design and implementation of a novel multi-core aware packet capture kernel module that enables monitoring applications to scale with the number of cores. We showcase that we can achieve high packet capture performance on modern commodity hardware.

show abstract

Section: Motivation and Scope Of Workmentioning

confidence: 99%

High speed network traffic analysis with commodity multi-core systems

Fusco

Deri²

2010

Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement

Self Cite

132

View full text Add to dashboard Cite

show abstract

“…Packets that match an FDIR filter are directed to the hardware queue specified by the filter. If this hardware queue is not used by the system, the packets will be just dropped at the NIC layer, and they will never be copied to the system's main memory [26]. When available, Scap uses FDIR filters to implement all above types of early packet discarding, otherwise packets are discarded within the OS kernel.…”

Section: A Subzero-copy Packet Transfermentioning

confidence: 99%

“…Deri et al [26] propose to use the flow director filters for common filtering needs. Other approaches allow applications to move simple tasks to the kernel packet filter to improve performance [42], [50], [51].…”

Section: Packet Filteringmentioning

confidence: 99%

Stream-Oriented Network Traffic Capture and Analysis for High-Speed Networks

Papadogiannakis

Polychronakis

Markatos

2014

IEEE J. Select. Areas Commun.

View full text Add to dashboard Cite

Abstract-Intrusion detection, traffic classification, and other network monitoring applications need to analyze the captured traffic beyond the network layer to allow for connection-oriented analysis, and achieve resilience to evasion attempts based on TCP segmentation. Existing network traffic capture frameworks, however, provide applications with raw packets and leave complex operations like flow tracking and TCP stream reassembly to application developers. This gap, between what applications need and what systems provide, leads to increased application complexity, longer development time, and most importantly, reduced performance due to excessive data copies between the packet capture subsystem and the stream processing module.This paper presents the Stream capture library (Scap), a network monitoring framework built from the ground up for stream-oriented traffic processing. Based on a kernel module that directly handles flow tracking and TCP stream reassembly, Scap delivers to user-level applications flow-level statistics and reassembled streams by minimizing data movement operations and discarding uninteresting traffic at early stages, while it inherently supports parallel processing on multi-core architectures, and uses advanced capabilities of modern network cards. Our experimental evaluation shows that Scap can capture all streams for traffic rates two times higher than other stream reassembly libraries. Finally, we present the implementation and performance evaluation of four popular network traffic monitoring applications built on top of Scap.

show abstract

“…to a core id that is greater than the number of available processor cores) instructs the adapter to drop such flow, hence implementing a wire-speed traffic filter and balancer. PF RING comes with a specialized driver for this adapter that allows applications to transparently set FD rules [10] whenever a filtering rule is set. This means that whenever an application adds/removes a filtering rule, the PF RING filtering engine attempts to transparently set the filter in hardware if the adapter supports it.…”

Section: A Programmable Network Monitoring Frameworkmentioning

confidence: 99%

“…The performance evaluation of the filtering infrastructure can be found in [10], whereas [9] reports the packet capture performance.…”

Section: Using Pf Ring For Network Service Monitoringmentioning

confidence: 99%

Towards Monitoring Programmability in Future Internet: Challenges and Solutions

Deri¹,

Fusco²,

Gasparakis³

2011

Trustworthy Internet

Self Cite

View full text Add to dashboard Cite

Internet is becoming a global IT infrastructure serving interactive and real-time services ubiquitously accessible by heterogeneous network-enabled devices. In the Internet of Services (IoS) era, monitoring infrastructures must provide to network operators fine-grained service-specific information which can be derived by dissecting application level protocols. To accommodate these new monitoring requirements network probes must be flexible, easy to extend and still be capable of analyzing high-speed network streams. Despite the increased complexity, software and hardware technologies on top of which network probes are implemented have been designed when monitoring requirements were substantially different and almost left unchanged. As a result, implementing modern probes is challenging and time consuming. In this paper we identify desirable features for reducing the work required to develop complex probes, and we present a home-grown comprehensive software framework that significantly simplifies the creation of service-oriented monitoring applications.

show abstract

Wire-Speed Hardware-Assisted Traffic Filtering with Mainstream Network Adapters

Cited by 9 publications

References 13 publications

High speed network traffic analysis with commodity multi-core systems

High speed network traffic analysis with commodity multi-core systems

Stream-Oriented Network Traffic Capture and Analysis for High-Speed Networks

Towards Monitoring Programmability in Future Internet: Challenges and Solutions

Contact Info

Product

Resources

About