Deep dive into Kernel

N/W 분석 필요성- The characterization of network protocols is required not only for creating accurate network traffic reports, but increasingly, for overall network security needs. DPI의 필요성, L4 분석으로는 모자람- Today, traffic inspection facilities are available on every modern network security device, because the binding port/protocol scheme no longer holds 통계적 방법의 한계가 있음- This difficulty triggered the dev..

netflow capture daemon nfcapd -l /tmp -p 2055 분석nfdump -r /tmp/

http://people.netfilter.org/hawk/presentations/nfws2014/dp-accel-10G-challenge.pdf Wirespeed smallest frame Sgine CPU core Ethernet specific (20 bytes)- 12 bytes = inter-frame gap- 8 bytes = MAC preamble Ethernet frame (64 bytes)- 14 bytes = MAC header- 46 bytes = Minimum payload size- 4 bytes = Ethernet CRC => Minimum size Ethernet frame is 84 bytes (20 + 64) Peak packet rate: 14,880,952 pps= 1..

nProbe가 동작하는 기본적인 skeleton 구조 Hash Tabledefinition: HashBucket **theHash[MAX_NUM_PCAP_THREADS], **thePrevHash[MAX_NUM_PCAP_THREADS]; #define HASH_SIZE 4096 /* buckets */ void allocateHash(int idx) { u_int mallocSize = sizeof(HashBucket*)*hashSize; theHash[idx] = (HashBucket**)calloc(1, mallocSize); if(theHash[idx] == NULL) { traceEvent(TRACE_ERROR, "Not enough memory"); exit(-1); } }... /* pcap-..

[Usenix ATC 2014] Pythia: Diagnosing Performance Problems in Wide Area Providers - Motivation : 실시간으로 네트워크 시스템 문제를 detect/diagnose 할 수 있는 기법 필요- Solution : near-realtime detection/diagnosis/localization -> enabling quick troubleshooting, works with data from exsiting monitoring deployments, diagnose short-lived performance problems

EX4500port당 14.88 Mpps *48 port = 714 Mpps - 개별 port 의 성능은 14.88 M * 64 bytes = 952MBps*8bit = 7618 Gbps- 즉 개별 port는 약 8Gbps의 포워딩 능력을 가짐

WindRiver- Intelligent Network Platform Cosmos- Service-Aware Network Architecture Based on SDN, NFV, and Network Intelligence Sandvine : Network Analyticshttps://www.sandvine.com/downloads/general/network-analytics/sandvine-network-analytics-product-overview.pdf

printf “1\tuplink0\n” >> /etc/iproute2/rt_tables printf “2\tuplink1\n” >> /etc/iproute2/rt_tables ip route add 192.168.0.211/32 dev eth0 src 192.168.0.211 table uplink0 ip route add default via 192.168.0.1 dev eth0 table uplink0 ip rule add from 192.168.0.211/32 table uplink0 ip rule add to 192.168.0.211/32 table uplink0 ip route add 192.168.0.212/32 dev eth1 src 192.168.0.212 table uplink1 ip r..

Juniper EX4500 configuration: Enter configuration menu: edit chassis set aggregated-devices ethernet device-count 2This will define the number of aggregated device in switch ( in this case w’ll create ae0 and ae1 ) Aggregated interfaces will be ge-0/0/4 and ge-0/0/5 edit interfaces set ge-0/0/4 ether-options 802.3ad ae0 set ge-0/0/5 ether-options 802.3ad ae0 set ae0 aggregated-ether-options mini..