申请试用
HOT
登录
注册
 
Research on DPDK Based High-Speed Network Traffic Analysis
幸运号
/
发布于
/
2269
人观看

网络流量分析的主要目的为:

  • 商业内容分析,比如运营上的广告推荐
  • 性能监控
  • 信息安全

DPDK作为一个高速网络互联手段,如何分析网络流量呢?

展开查看详情

1 .Research on DPDK Based High-Speed Network Traffic Analysis Zihao Wang Network & Information Center Shanghai Jiao Tong University

2 .Outline 1 Background 2 Overview 3 DPDK Based Traffic Analysis 4 Experiment 5 Conclusion

3 . Page . 3 Usage of Traffic ▪ Business Benefit ▪ ISPs’ personalized advertising ▪ Performance Monitoring ▪ Security

4 . Page . 4 Mainstream Traffic Analysis Method ▪ Protocol Analysis ▪ Port based method ▪ Payload based method ▪ Statistical approach based method ▪ Content Analysis

5 . Page . 5 Current Packet Capture Engine ▪ Libpcap/Winpcap ▪ PF_RING ▪ Netmap

6 . Page . 6 DPDK Framework

7 . Page . 7 Why DPDK ▪ Zero Copy ▪ Poll Mode Driver Architecture ▪ Fine Hardware Support ▪ Use Pointer As Much As Possible ▪ Easy-to-use Ring Manager ▪ Packet Forwarding Algorithm Support ▪ Native IPv6 Support

8 . Page . 8 Traditional Capture Engine

9 . Page . 9 Traditional Capture Engine

10 . Page . 10 DPDK Based Traffic Analysis System ▪ Load balancing

11 . Page . 11 DPDK Based Packet Capture ▪ pdump User Space

12 . Page . 12 DPDK Based Packet Capture ▪ KNI User Space

13 . Page . 13 DPDK Based Packet Capture ▪ Pdump Based ▪ Copied by port driver ▪ Dumped by pdump program ▪ KNI Based ▪ Copied in user space ▪ Send to kernel ▪ Dumped by pcap API

14 . Page . 14 DPDK Based Packet Capture ▪ Pdump Based ▪ Easy to use ▪ Copied once ▪ KNI Based ▪ Need to create new thread ▪ Poor performance ▪ Highly customizable ▪ System API supported ▪ Recommended for bypass capture

15 . Page . 15 DPDK Based Traffic Analysis System ▪ Basic Architecture

16 . Page . 16 DPDK Based Packet Capture ▪ User Space

17 . Page . 17 Compared with DPDK Based Packet Capture ▪ Pdump Based ▪ Slow down the main business ▪ Uncompressed file IO ▪ Copy at least once ▪ KNI Based ▪ Poor performance ▪ Using kernel protocol stack ▪ More copy operation

18 . Page . 18 DPDK Based Packet Analysis

19 . Page . 19 DPDK Based Packet Analysis ▪ Multiple Producers Queue ▪ Flow Classification Support ▪ Highly customizable ▪ Improve CPU cache hit rate ▪ Avoid resource competition ▪ Expand support for both dimensions

20 . Page . 20 Detailed Design ▪ Environment Abstraction Layer ▪ Set CPU affinity ▪ Set Hugepage ▪ Reload hardware by PMD

21 . Page . 21 Detailed Design ▪ Packet Capture Layer ▪ Get device information ▪ Initialize ports ▪ RSS ▪ Producer queue ▪ Consumer queue ▪ Binding threads

22 . Page . 22 Detailed Design ▪ Packet Capture Layer ▪ Initialize ports

23 . Page . 23 Detailed Design ▪ Packet Processing Layer ▪ Consumer queue management ▪ Data analysis ▪ Software migration

24 . Page . 24 Detailed Design ▪ Packet Processing Layer ▪ Pcap compatible

25 . Page . 25 Detailed Design ▪ Packet Processing Layer ▪ IPv6 support ▪ Making use of kernel protocol stack

26 . Page . 26 Detailed Design ▪ Packet Processing Layer ▪ IPv6 support ▪ Making use of kernel protocol stack

27 . Page . 27 Detailed Design ▪ Packet Processing Layer ▪ IPv6 support ▪ Make use of DPDK IPv6 Support

28 . Page . 28 Detailed Design ▪ Packet Processing Layer ▪ IPv6 support ▪ Make use of DPDK IPv6 Support

29 . Page . 29 Performance Testing ▪ Using SJTU campus network traffic as testing background ▪ Add feature packets to the traffic ▪ Using analysis system dealing with the traffic ▪ Counting feature ones in the analysis result ▪ Comparing with the number of total feature packets, and evaluating system performance

0 点赞
0 收藏
0下载
确认
3秒后跳转登录页面
去登陆