Traffic Analysis with Off-the-Shelf Hardware: Challenges and Lessons Learned

Abstract :

In recent years, the progress in both hardware and software allows user-space applications to capture packets at 10 Gb/s line rate or more, with cheap COTS hardware. However, processing packets at such rates with software is still far from being trivial. In the literature, this challenge has been extensively studied for network intrusion detection systems, where per-packet operations are easy to parallelize with support of hardware acceleration. Conversely, the scalability of statistical traffic analyzers (STAs) is intrinsically complicated by the need to track per-flow state to collect statistics. This challenge has received less attention so far, and it is the focus of this work. We present and discuss design choices to enable a STA to collects hundreds of per-flow metrics at a multi-10-Gb/s line rate. We leverage a handful of hardware advancements proposed over the last years (e.g., RSS queues, NUMA architecture), and we provide insights on the trade-offs they imply when combined with state-of-the-art packet capture libraries and the multi-process paradigm. We outline the principles to design an optimized STA, and we implement them to engineer DPDKStat, a solution combining the Intel DPDK framework with the traffic analyzer Tstat. Using traces collected from real networks, we demonstrate that DPDKStat achieves 40 Gb/s of aggregated rate with a single COTS PC

Type de document :
Article dans une revue
IEEE Communication Magazine, 2017, 55 (3), pp.163 - 169
Liste complète des métadonnées

https://hal-imt.archives-ouvertes.fr/hal-01613500
Contributeur : Admin Télécom Paristech <>
Soumis le : lundi 9 octobre 2017 - 16:40:03
Dernière modification le : jeudi 11 janvier 2018 - 06:23:39

Identifiants

  • HAL Id : hal-01613500, version 1

Citation

Trevisan Martino, Alessandro Finamore, M. Mellia, M. Munafo, Dario Rossi. Traffic Analysis with Off-the-Shelf Hardware: Challenges and Lessons Learned. IEEE Communication Magazine, 2017, 55 (3), pp.163 - 169. 〈hal-01613500〉

Partager

Métriques

Consultations de la notice

56