Wire-Speed Statistical Classification of Network Traffic on Commodity Hardware

Pedro Maria Santiago del Rio (1, 2) , D. Rossi (1, 3, 4) , Francesco Gringoli (5) , Lorenzo Nava (5) , Luca Salgarelli (5) , Javier Aracil (2)

1 LINCS - Laboratory of Information, Network and Communication Sciences
2 Escuela Politécnica Superior [Madrid]
3 RMS - Réseaux, Mobilité et Services
4 INFRES - Département Informatique et Réseaux
5 tlc groupe - Telecommunication Group

In this paper we present a software-based traffic classification engine running on commodity multi-core hardware, able to process in real-time aggregates of up to 14.2 Mpps over a single 10 Gbps interface – i.e., the maximum possible packet rate over a 10 Gbps Ethernet links given the minimum frame size of 64 Bytes. This significant advance with respect to the current state of the art in terms of achieved classification rates are made possible by: (i) the use of an improved network driver, PacketShader, to efficiently move batches of packets from the NIC to the main CPU; (ii) the use of lightweight statistical classification techniques exploiting the size of the first few packets of every observed flow; (iii) a careful tuning of critical parameters of the hardware environment and the software application itself.

Domains: Computer Science [cs]; Networking and Internet Architecture [cs.NI]

Pedro Maria Santiago del Rio, D. Rossi, Francesco Gringoli, Lorenzo Nava, Luca Salgarelli, et al.. Wire-Speed Statistical Classification of Network Traffic on Commodity Hardware. ACM SIGCOMM Internet Measurement Conference (IMC), Nov 2012, Boston, United States. pp.65-72. ⟨hal-00796421⟩