MONSTER. Managing an Operator s Network with Software Defined Networking and Segment Routing. Ing. Luca Davoli
|
|
|
- Miranda Rice
- 5 years ago
- Views:
Transcription
1 MONSTER Managing an Operator s Network with Software Defined Networking and Segment Routing Ing. Luca Davoli davoli@ce.unipr.it Tutor: Prof. Ing. Luca Veltri UNIVERSITÀ DEGLI STUDI DI PARMA
2 Overview Segment Rou<ng Traffic Engineering with SDN & SR IPv6 SR: Alterna<ves and Solu<ons Network Emulator (NEMO) Service Func<on Chaining & Network Func<on Virtualiza<on SR/Virtual Func<on Chaining SR and Network Func<ons SR- aware architecture SR- unaware architecture Luca Davoli Borsisti Day
3 Segment Routing Segment Rou<ng (SR): based on source rou<ng Enhanced packet forwarding without any topological restric<ons and addi<onal signaling requirements Segments based on MPLS or IPv6 Luca Davoli Borsisti Day
4 Traffic Engineering with SDN ISP network managed by a (logically) centralized SDN controller Provider Edge (PE) routers and Core Routers (CR) are hybrid IP/MPLS/ SDN nodes MPLS is used for TE TE paths enforced by using Segment Rou<ng (SR) no change to the MPLS forwarding plane is required no MPLS control plane has to be used Luca Davoli Borsisti Day
5 Traffic Engineering with Segment Routing Enhancement of a SDN controller with TE/SR modules The SDN controller is requested to allocate a set of traffic flows with a specified bit rate The flow assignment algorithm is first executed in order to compute TE paths Minimiza<on of the overall network crossing <me For each TE path, the corresponding SR path is calculated SR path is the list of SIDs that should be added to incoming packets for instruc<ng them through the assigned TE path Simple SR assignment algorithm that minimizes the number of required SIDs Studied different SR algorithms Luca Davoli Borsisti Day
6 Implementation and tests Proposed network architecture has been implemented and tested Experimental analysis with two main goals: tes<ng the SR assignment algorithm 153 nodes, 354 links, 940 out of 2460 flows tes<ng the overall implementa<on of the solu<on both control and data planes Luca Davoli Borsisti Day
7 IPv6 SR IPv6 SR support requires the changing of IPv6 packet processing IPv6 Segment Rou<ng Header (SRH) haps://tools.ieb.org/html/drac- ieb- 6man- segment- rou<ng- header Luca Davoli Borsisti Day
8 IPv6 SR src: 2001:7a:78d::1 src: 2001:7a:78d::1 src: 2001:7a:78d::1 src: 2001:7a:78d::1 src: 2001:7a:78d::1 dst: 2001:7a:78d::11 dst: 2001:7a:78d::21 dst: 2001:7a:78d::31 dst: 2001:7a:78d::41 dst: 2001:7a:78d::51 nh len 4 4 nh len 4 3 nh len 4 2 nh len 4 1 nh len 4 0 reserved reserved reserved reserved reserved Routing Header addr[0]: 2001:7a:78d::51 addr[1]: 2001:7a:78d::41 addr[0]: 2001:7a:78d::51 addr[1]: 2001:7a:78d::41 addr[0]: 2001:7a:78d::51 addr[1]: 2001:7a:78d::41 addr[0]: 2001:7a:78d::51 addr[1]: 2001:7a:78d::41 addr[0]: 2001:7a:78d::51 addr[1]: 2001:7a:78d::41 addr[2]: 2001:7a:78d::31 addr[2]: 2001:7a:78d::31 addr[2]: 2001:7a:78d::31 addr[2]: 2001:7a:78d::31 addr[2]: 2001:7a:78d::31 addr[3]: 2001:7a:78d::21 addr[3]: 2001:7a:78d::21 addr[3]: 2001:7a:78d::21 addr[3]: 2001:7a:78d::21 addr[3]: 2001:7a:78d::21 addr[4]: 2001:7a:78d::11 addr[4]: 2001:7a:78d::11 addr[4]: 2001:7a:78d::11 addr[4]: 2001:7a:78d::11 addr[4]: 2001:7a:78d:: :7a:78d::1 2001:7a:78d:: :7a:78d:: :7a:78d:: :7a:78d:: :7a:78d::51 packet source specified router non-specified router packet final destination Luca Davoli Borsisti Day
9 IPv6 SR Alterna<ves for suppor<ng IPv6 SR on Linux Modifica<on of the Linux kernel Kernel- level dev Highest performance Nebilter hooks + kernel modules Kernel module dev Iptables NFQUEUE + userspace dev User level dev Compa<ble with JNI- based userspace dev Neither Kernel modifica<on nor kernel module required Rawsocket User level dev Luca Davoli Borsisti Day
10 IPv6 SR on Linux: kernel patch Kernel modifica<on Available patch from UCLovail, Belgium Different experimental tests Different kernels tested Limita<ons Require a patched Linux kernel Lower flexibility Difficulty to combine SRH processing with possible network func<ons Issues with large- scale network emula<on Problems with Mininet Luca Davoli Borsisti Day
11 IPv6 SR on Linux: netfilter Nebilter Framework in Linux kernel for packet mangling Series of hooks in various points of the kernel network stack The hooks can be exploited to define custom func<ons for manipula<ng IP packets Local Process tables mangle filter INPUT OUTPUT tables mangle nat filter PREROUTING routing decision FORWARD POSTROUTING Outgoing tables mangle nat tables mangle filter tables mangle nat Luca Davoli Borsisti Day
12 IPv6 SR on Linux: Userspace SR implementa<on Packets are captured in prerou<ng, enqueued (NFQUEUE), processed at userspace, returned with SRH updated C, JNI, Java development C JNI library for receiving packets form the nebilter queue providing a Java interface to nebilter queues Java- based SR processing Note: no kernel modifica<on required ip6tables -t mangle -A PREROUTING -p ipv6 -j NFQUEUE --queue-num 0 Luca Davoli Borsisti Day
13 IPv6 SR on Linux: Testbed IPH SR encapsula<on JNI library SR processing JNI library SR processing (& removal) JNI library IPH Output Prerou<ng Prerou<ng Linux VM1 fc00:1::21 SRH IPH Linux VM2 fc00:1::22 SRH IPH Linux VM3 fc00:1::23 IPH: SA=fc00:1::21 DA=fc00:1::23 DA SRH: SID1=fc00:1::22 SID2=fc00:1::23 SID3=fc00:1::23 DA SRH: SID1=fc00:1::22 SID2=fc00:1::23 SID3=fc00:1::23 Luca Davoli Borsisti Day
14 SR and Network Implementation Java Network Stack Netfilter-based SR Impl UdpLayer Routing Segment Routing Ip4Layer Ip6Layer IPv6SR Function Other network functions IcmpLayer ARP IpNode Icmp6Layer Ethernet PacketHandler NetfilterQueue JNI libqfilter.so Linux Netfilter Ip4Socket Ip6Socket RawIpSocket Socket JNI libqfilter.so Linux Raw Sockets RawLinkSocket Luca Davoli Borsisti Day
15 Network Emulator (NEMO) Java- based framework able to emulate an IP- based network (based on the Java Network Stack) large amount of virtual routers Possibility to interconnect a real network card with mul<ple NICs route traffic coming from/going to an external IP- based network Complete IP stack Ethernet / ARP / IPv4 / IPv6 / ICMP / ICMPv6 / UDP Rou<ng Func<on Shortest Path for dynamic RT configura<on Unix- based plaborms: possibility to intercept incoming packets with Rawsocket mechanism (at Ethernet layer) Integra<on successfully tested and verified Possibility to deploy virtual networks whose rou<ng is handled via SRH Luca Davoli Borsisti Day
16 Service Function Chaining & Network Function Virtualization SR as enabler technology for SFC Set of network services interconnected through the network to support an applica<on SFs or NFs can be physically deployed or virtualized (NFV) NFV moves network func<ons out of dedicated HW and into SW Network func<ons typically execute as VMs under control of an hypervisor Luca Davoli Borsisti Day
17 SR/VNF Chaining Architecture Luca Davoli Borsisti Day
18 SR and Network Functions SR- aware Network Func<ons SR packets are passed to the NF NF may enforce other NFs modifying the segment list in the SRH inserted between this node and the next segment inserted in any posi<on along the SR path the NF is aware of the NFs corresponding to the segment IDs already present in the segment list adds, removes, changes the order of the next segments SR- unaware Network Func<ons packets are first processed before the NF original packet is extracted (without the SRH) the SR list is in some way stored in order to be re- aaached to the packet when returned by the NF Stateful/Stateless Luca Davoli Borsisti Day
19 SR/VNF Chaining Implementation Based on the userspace SR development Packets are captured in prerou<ng and passed to a set of NFs Note: SR can be seen as special case of NF Both SR- aware and SR- unaware NFs are supported In case of SR- unaware NFs, SRH removed and inserted in IPv6 Des<na<on Op<ons Extension Header Stateless mechanism SRH reinserted in postrou<ng Example of SR- unaware NF: nebilter firewall Luca Davoli Borsisti Day
20 SR/VNF Chaining Testbed SRF Chain NF1 SRH remove SR encapsula<on JNI library JNI library NFn SRF JNI SRH add JNI IPH Postrou<ng Prerou<ng Prerou<ng NF Postrou<ng IPH SRH IPH SRH IPH Linux Linux Linux Luca Davoli Borsisti Day
21 MONSTER Managing an Operator s Network with Software Defined Networking and Segment Routing Thanks for your a3en5on!
Implemen'ng IPv6 Segment Rou'ng in the Linux Kernel
Implemen'ng IPv6 Segment Rou'ng in the Linux Kernel David Lebrun, Olivier Bonaventure ICTEAM, UCLouvain Work supported by ARC grant 12/18-054 (ARC-SDN) and a Cisco grant Agenda IPv6 Segment Rou'ng Implementa'on
Software-Defined Networking (SDN) Overview
Reti di Telecomunicazione a.y. 2015-2016 Software-Defined Networking (SDN) Overview Ing. Luca Davoli Ph.D. Student Network Security (NetSec) Laboratory davoli@ce.unipr.it Luca Davoli davoli@ce.unipr.it
IPtables and Netfilter
in tables rely on IPtables and Netfilter Comp Sci 3600 Security Outline in tables rely on 1 2 in tables rely on 3 Linux firewall: IPtables in tables rely on Iptables is the userspace module, the bit that
Netfilter. Fedora Core 5 setting up firewall for NIS and NFS labs. June 2006
Netfilter Fedora Core 5 setting up firewall for NIS and NFS labs June 2006 Netfilter Features Address Translation S NAT, D NAT IP Accounting and Mangling IP Packet filtering (Firewall) Stateful packet
Network Administra0on
Network Administra0on (Introduc0on) Administración en Red 1 Index Introduc0on (TCP/IP) Network Interface Link Layer Network Layer Monitoring/Test Administración en Red 2 Introduc0on (TCP/IP) Protocol Suite,
Implementation of Virtual Network Function Chaining through Segment Routing in a Linux-based NFV Infrastructure
Implementation of Virtual Network Function Chaining through Segment Routing in a Linux-based NFV Infrastructure Ahmed AbdelSalam, Francois Clad, Clarence Filsfils, Stefano Salsano, Giuseppe Siracusano,
Worksheet 8. Linux as a router, packet filtering, traffic shaping
Worksheet 8 Linux as a router, packet filtering, traffic shaping Linux as a router Capable of acting as a router, firewall, traffic shaper (so are most other modern operating systems) Tools: netfilter/iptables
Some of the slides borrowed from the book Computer Security: A Hands on Approach by Wenliang Du. Firewalls. Chester Rebeiro IIT Madras
Some of the slides borrowed from the book Computer Security: A Hands on Approach by Wenliang Du Firewalls Chester Rebeiro IIT Madras Firewall Block unauthorized traffic flowing from one network to another
sottotitolo A.A. 2016/17 Federico Reghenzani, Alessandro Barenghi
Titolo presentazione Piattaforme Software per la Rete sottotitolo Firewall and NAT Milano, XX mese 20XX A.A. 2016/17, Alessandro Barenghi Outline 1) Packet Filtering 2) Firewall management 3) NAT review
Introduc)on to SDN and NFV. Tomás Lynch Solu/on Architect III Ericsson
Introduc)on to SDN and NFV Tomás Lynch Solu/on Architect III Ericsson SoBware- Defined Networking THE PATH TO SDN Introduc)on to SDN & NFV Ericsson AB 2015 2015-09- 25 Page 2 IP Router Evolu)on In the
IPv6 NAT. Open Source Days 9th-10th March 2013 Copenhagen, Denmark. Patrick McHardy
IPv6 NAT Open Source Days 9th-10th March 2013 Copenhagen, Denmark Patrick McHardy Netfilter and IPv6 NAT historically http://lists.netfilter.org/pipermail/netfilter/2005-march/059463.html
CSC 474/574 Information Systems Security
CSC 474/574 Information Systems Security Topic 7.4 Firewalls CSC 474/574 Dr. Peng Ning 1 Outline What are firewalls? Types Filtering Packet filtering Session filtering Proxy Circuit Level Application Level
Netfilter & Packet Dropping
Netfilter & Packet Dropping Netfilter provides a set of hooks is several points of the kernel network stack. The hooks can be exploited to define custom functions for manipulating IP packets Dropping Manipulation
Linux IP Networking. Antonio Salueña
Linux IP Networking Antonio Salueña Preface We will study linux networking for the following case: Intel x86 architecture IP packets Recent stable linux kernel series 2.4.x 2 Overview
Firewalls. IT443 Network Security Administration Slides courtesy of Bo Sheng
Firewalls IT443 Network Security Administration Slides courtesy of Bo Sheng 1 Internet Security Mechanisms Prevent: Firewall, IPsec, SSL Detect: Intrusion Detection Survive/ Response: Recovery, Forensics
Lesson 9 OpenFlow. Objectives :
1 Lesson 9 Objectives : is new technology developed in 2004 which introduce Flow for D-plane. The Flow can be defined any combinations of Source/Destination MAC, VLAN Tag, IP address or port number etc.
SRv6 Network Programming
SRv6 Network Programming FD.io VPP and Linux Pablo Camarillo - Software Engineer @ Cisco Systems Ahmed Abdelsalam PhD student @ Gran Sasso Science Institute Who are we? Ahmed Abdelsalam PhD student @ Gran
Dual stack lite. draft-durand-softwire-dual-stack-lite-01. A. Durand, R. Droms, B. Haberman, J. Woodya<
Dual stack lite draft-durand-softwire-dual-stack-lite-01 A. Durand, R. Droms, B. Haberman, J. Woodya< Router based scenario: Home router is provisioned with IPv6 on WAN and tunnel concentrator address;
Firewalls. Firewall. means of protecting a local system or network of systems from network-based security threats creates a perimeter of defense
FIREWALLS 3 Firewalls Firewall means of protecting a local system or network of systems from network-based security threats creates a perimeter of defense administered network public Internet firewall
Advanced Linux System Administra3on
Advanced Linux System Administra3on Subject 11. Network administra3on (Introduc3on). Pablo Abad Fidalgo José Ángel Herrero Velasco Departamento de Ingeniería Informá2ca y Electrónica Este tema se publica
A 10 years journey in Linux firewalling Pass the Salt, summer 2018 Lille, France Pablo Neira Ayuso
A 10 years journey in Linux firewalling Pass the Salt, summer 2018 Lille, France Pablo Neira Ayuso What is Netfilter? Not just iptables Image from Wikipedia (J. Engelhardt, 2018)
Linux. Sirindhorn International Institute of Technology Thammasat University. Linux. Firewalls with iptables. Concepts. Examples
Linux Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 14 October 2013 Common/Reports/-introduction.tex, r715 1/14 Contents 2/14 Linux, netfilter and netfilter:
OPTIMAL ROUTING VS. ROUTE REFLECTOR VNF - RECONCILE THE FIRE WITH WATER
OPTIMAL ROUTING VS. ROUTE REFLECTOR VNF - RECONCILE THE FIRE WITH WATER Rafal Jan Szarecki #JNCIE136 Solu9on Architect, Juniper Networks. AGENDA Route Reflector VNF - goals Route Reflector challenges and
Lecture 8. Network Layer (cont d) Network Layer 1-1
Lecture 8 Network Layer (cont d) Network Layer 1-1 Agenda The Network Layer (cont d) What is inside a router Internet Protocol (IP) IPv4 fragmentation and addressing IP Address Classes and Subnets Network
Network Security Fundamentals
Network Security Fundamentals Security Training Course Dr. Charles J. Antonelli The University of Michigan 2013 Network Security Fundamentals Module 6 Firewalls & VPNs Topics Firewall Fundamentals Case
OpenContrail as SDN controller for NFV infrastructure in AT&T network Alexey Gorbunov Network Architect CCIE 41088
OpenContrail as SDN controller for NFV infrastructure in AT&T network Alexey Gorbunov Network Architect CCIE 41088 What we re doing: AT&T Wireless Mobility Network We re a suppor+ng a large network infrastructure
Firewalling. Alessandro Barenghi. May 19, Dipartimento di Elettronica e Informazione Politecnico di Milano barenghi - at - elet.polimi.
Firewalling Alessandro Barenghi Dipartimento di Elettronica e Informazione Politecnico di Milano barenghi - at - elet.polimi.it May 19, 2011 Recap By now, you should be familiar with... Programming with
Lecture 3. The Network Layer (cont d) Network Layer 1-1
Lecture 3 The Network Layer (cont d) Network Layer 1-1 Agenda The Network Layer (cont d) What is inside a router? Internet Protocol (IP) IPv4 fragmentation and addressing IP Address Classes and Subnets
Network security Exercise 9 How to build a wall of fire Linux Netfilter
Network security Exercise 9 How to build a wall of fire Linux Netfilter Tobias Limmer Computer Networks and Communication Systems Dept. of Computer Sciences, University of Erlangen-Nuremberg, Germany 2.2.
Lecture 10.1 A real SDN implementation: the Google B4 case. Antonio Cianfrani DIET Department Networking Group netlab.uniroma1.it
Lecture 10.1 A real SDN implementation: the Google B4 case Antonio Cianfrani DIET Department Networking Group netlab.uniroma1.it WAN WAN = Wide Area Network WAN features: Very expensive (specialized high-end
Next hop in rou-ng Summary of Future Internet WP1 work. Hannu Flinck
Next hop in rou-ng Summary of Future Internet WP1 work Hannu Flinck Original focus on Rou-ng Scalability Mo$va$on: Internet Architecture Board stated (in RFC 4984): rou-ng scalability is the most important
Donato Ba*aglino Lorenzo Bracciale
IP Donato Ba*aglino Lorenzo Bracciale Outline why IP (mo:va:on) IP architecture (router, LAN) IP addressing Sta:c IP (CIDR, host + net) DHCP Rou:ng IP ARP Why IP? There are many different LAN technologies
Network Address Translation
Claudio Cicconetti International Master on Communication Networks Engineering 2006/2007 Network Address Translation (NAT) basically provides a mapping between internal (i.e.,
Link Layer. w/ much credit to Cisco CCNA and Rick Graziani (Cabrillo)
Link Layer w/ much credit to Cisco CCNA and Rick Graziani (Cabrillo) Administra>via How are the labs going? Telnet- ing into Linux as root In /etc/pam.d/remote comment out line auth required pam_securely.so
Packet Filtering and NAT
Packet Filtering and NAT Alessandro Barenghi Dipartimento di Elettronica e Informazione Politecnico di Milano barenghi - at - elet.polimi.it May 14, 2014 Lesson contents Overview Netfilter/Iptables Structure
Network layer overview
Network layer overview understand principles behind layer services: layer service models forwarding versus rou:ng how a router works rou:ng (path selec:on) broadcast, mul:cast instan:a:on, implementa:on
Definition of firewall
Internet Firewalls Definitions: firewall, policy, router, gateway, proxy NAT: Network Address Translation Source NAT, Destination NAT, Port forwarding NAT firewall compromise via UPnP/IGD Packet filtering
Assignment 3 Firewalls
LEIC/MEIC - IST Alameda LEIC/MEIC IST Taguspark Network and Computer Security 2013/2014 Assignment 3 Firewalls Goal: Configure a firewall using iptables and fwbuilder. 1 Introduction This lab assignment
Laboratory 2 Dynamic routing using RIP. Iptables. Part1. Dynamic Routing
Introduction Laboratory 2 Dynamic routing using RIP. Iptables. Part1. Dynamic Routing Static routing has the advantage that it is simple, requires no computing power in router for determining routes (this
Basic elements of IP and its interac2on with Ethernet
Basic elements of IP and its interac2on with Ethernet IP addressing, Forwarding, ARP, ARP poisoning Marco Bonola, Lorenzo Bracciale Corso di Fondamen2 di Re2 e Segnali Prof. Giuseppe Bianchi A.A. 2010
Data Center Configuration. 1. Configuring VXLAN
Data Center Configuration 1. 1 1.1 Overview Virtual Extensible Local Area Network (VXLAN) is a virtual Ethernet based on the physical IP (overlay) network. It is a technology that encapsulates layer 2
VPN-against-Firewall Lab: Bypassing Firewalls using VPN
SEED Labs 1 VPN-against-Firewall Lab: Bypassing Firewalls using VPN Copyright c 2016 Wenliang Du, Syracuse University. The development of this document was partially funded by the National Science Foundation
Routing Header Is back... Should We Panic?
Routing Header Is back... Should We Panic? Leveraging IPv6 extension header for traffic engineering Eric Vyncke (evyncke@cisco.com also @evyncke) Distinguished Engineer Cisco Systems March, 2015 Where
Suricata IDPS and Nftables: The Mixed Mode
Suricata IDPS and Nftables: The Mixed Mode Giuseppe Longo Stamus Networks Jul 5, 2016 Giuseppe Longo (Stamus Networks) Suricata IDPS and Nftables: The Mixed Mode Jul 5, 2016 1 / 60 1 Netfilter Nftables
Network Administration
Intro Network stack, brutalized Firewalling S/DNAT Dipartimento di Elettronica, Informazione e Bioingegneria Politecnico di Milano barenghi - at - elet.polimi.it April 9, 2013 Intro Network stack, brutalized
SIMPLE ROUTER PROJECT 2. - Balachander Padmanabha - TA CSE 123 (FALL 2017) - OH (Wed 9-11am B240A)
SIMPLE ROUTER PROJECT 2 - Balachander Padmanabha - TA CSE 123 (FALL 2017) - OH (Wed 9-11am B240A) MININET It is a network emulation orchestration system which runs a collection of end-hosts, switches,
Load Balancing Bloxx Web Filter. Deployment Guide v Copyright Loadbalancer.org
Load Balancing Bloxx Web Filter Deployment Guide v1.3.5 Copyright Loadbalancer.org Table of Contents 1. About this Guide...4 2. Loadbalancer.org Appliances Supported...4 3. Loadbalancer.org Software Versions
Supporting Fine-Grained Network Functions through Intel DPDK
Supporting Fine-Grained Network Functions through Intel DPDK Ivano Cerrato, Mauro Annarumma, Fulvio Risso - Politecnico di Torino, Italy EWSDN 2014, September 1st 2014 This project is co-funded by the
draft-xu-mpls-unified-source-routing-instruction
draft-xu-mpls-unified-source-routing-instruction xuxiaohu@huawei.com, stewart.bryant@gmail.com, robert@raszuk.net, uma.chunduri@gmail.com, luismiguel.contrerasmurillo@telefonica.com, luay.jalil@verizon.com,
Introduction to Firewalls using IPTables
Introduction to Firewalls using IPTables The goal of this lab is to implement a firewall solution using IPTables, and to write and to customize new rules to achieve security. You will need to turn in your
VALE: a switched ethernet for virtual machines
L < > T H local VALE VALE -- Page 1/23 VALE: a switched ethernet for virtual machines Luigi Rizzo, Giuseppe Lettieri Università di Pisa http://info.iet.unipi.it/~luigi/vale/ Motivation Make sw packet processing
Network Layer Overview. Star8ng the Network Layer! Builds on the link layer. Routers send packets over mul8ple networks
Introduc8on to Computer Networks Network Layer Overview Computer Science & Engineering Where we are in the Course Star8ng the Network Layer! Builds on the link layer. Routers send packets over mul8ple
Introduc3on to Computer Networks
Introduc3on to Computer Networks Network Layer Overview Computer Science & Engineering Where we are in the Course Star3ng the Network Layer! Builds on the link layer. Routers send packets over mul3ple
Performance Considerations of Network Functions Virtualization using Containers
Performance Considerations of Network Functions Virtualization using Containers Jason Anderson, et al. (Clemson University) 2016 International Conference on Computing, Networking and Communications, Internet
Evaluating the performance of Netfilter architecture in Private Realm Gateway
Ganesh Sharma Evaluating the performance of Netfilter architecture in Private Realm Gateway School of Electrical Engineering Thesis submitted for examination for the degree of Master of Science in Technology.
PRISTINE Project A different approach to SDN
PRISTINE Project A different approach to SDN Joan A. García-Espín Area Director Distributed Apps and Nets January 30 th, 2014 RINA Research, Korea-EU Workshop Primary Goals of SDN 1. Commodi(za(on of network
ProAc&ve Rou&ng In Scalable Data Centers with PARIS
ProAc&ve Rou&ng In Scalable Data Centers with PARIS Theophilus Benson Duke University Joint work with Dushyant Arora + and Jennifer Rexford* + Arista Networks *Princeton University Data Center Networks
The Research and Application of Firewall based on Netfilter
Available online at www.sciencedirect.com Physics Procedia 25 (2012 ) 1231 1235 2012 International Conference on Solid State Devices and Materials Science The Research and Application of Firewall based
Network and Filesystem Security
Network and Filesystem Security Powell Molleti powell@in.ibm.com 1 Agenda Netfilter and TCP Wrappers for Network Security including SNORT for NIDS and tools for checking network vulnerabilities Filesystem
CSC 4900 Computer Networks: Network Layer
CSC 4900 Computer Networks: Network Layer Professor Henry Carter Fall 2017 Chapter 4: Network Layer 4. 1 Introduction 4.2 What s inside a router 4.3 IP: Internet Protocol Datagram format 4.4 Generalized
CS-435 spring semester Network Technology & Programming Laboratory. Stefanos Papadakis & Manolis Spanakis
CS-435 spring semester 2016 Network Technology & Programming Laboratory University of Crete Computer Science Department Stefanos Papadakis & Manolis Spanakis CS-435 Lecture #4 preview ICMP ARP DHCP NAT
Addressing and Routing
Addressing and Routing Andrew Scott a.scott@lancaster.ac.uk Physical/ Hardware Addresses Aka MAC* or link(-layer) address Can only talk to things on same link Unique ID given to every network interface
Ethernet/IP interac.on emulated with NETKIT. DHCP relay, proxy ARP, Port stealing and ARP poisoning adack.
Ethernet/IP interac.on emulated with NETKIT. DHCP relay, proxy ARP, Port stealing and ARP poisoning adack. Marco Bonola, Lorenzo Bracciale Corso di Re. di Accesso e Trasporto Tor Vergata Prof. Stefano
CSE/EE 461: Introduction to Computer Communications Networks Autumn Module 9
CSE/EE 461: Introduction to Computer Communications Networks Autumn 2010 Module 9 IP Addressing John Zahorjan zahorjan@cs.washington.edu 534 Allen Center Last Time: Addresses Imply Location 142.150.210.12
Understanding Load Balance and Policy Route. andrew zheng! edcwifi co limited
Understanding Load Balance and Policy Route 1 andrew zheng! edcwifi co limited About Me Mikrotik Trainer No. 75! Certificate: MTCNA, MTCWE, MTCRE, MTCTCE, MTCUME, MTCINE, UBWA, UEWA 2 About EDCwifi Mikrotik
These slides contain significant content contributions by
OpenFlow In Depth This document is a result of work by the Network Startup Resource Center (NSRC at http://www.nsrc.org) and Indiana Center for Network Translational Research and Education (InCNTRE). This
CS Computer and Network Security: Firewalls
CS 5410 - Computer and Network Security: Firewalls Professor Patrick Traynor Fall 2017 Reminders Monday: Change of Plans Recording lecture - turn in your rules. Friday: Project Abstract The hardest paragraph
Università Ca Foscari Venezia
Firewalls Security 1 2018-19 Università Ca Foscari Venezia www.dais.unive.it/~focardi secgroup.dais.unive.it Networks are complex (image from https://netcube.ru) 2 Example: traversal control Three subnetworks:
IP/ICMP Translation Algorithm (IIT) Xing Li, Congxiao Bao, Fred Baker
IP/ICMP Translation Algorithm (IIT) Xing Li, Congxiao Bao, Fred Baker 2008-11-17 Abstract This document specifies an update to the Stateless IP/ICMP Translation Algorithm described in RFC 2765. The algorithm
Dropping Packets in Ubuntu Linux using tc and iptables
Dropping Packets in Ubuntu Linux using tc and... 1 Dropping Packets in Ubuntu Linux using tc and iptables By Steven Gordon on Tue, 18/01/2011-8:13pm There are two simple ways to randomly drop packets on
Toward an ebpf-based clone of iptables
Toward an ebpf-based clone of iptables Matteo Bertrone, Sebastiano Miano, Jianwen Pi, Fulvio Risso, Massimo Tumolo Netdev 0x12, Montréal (Canada), July 12th, 2018 Objective Started in Nov 2017, with a
Seamless Overlays for Application Use
1. Overview Seamless Overlays for Application Use Graduate Independent Study, 600.810.12 Edmund Duhaime Advisors: Dr. Yair Amir, Amy Babay May 18, 2017 This project focuses on methods for allowing unmodified
Outline today. MPLS Overview. We saw tunneling on top of IP. What about tunneling below IP? Introducing Mul<- Protocol Label Switching (MPLS) 3/21/11
UNDERLAYS and MIDDLEBOXES Outline today Network- layer principles Globally unique iden
Initial motivation: 32-bit address space soon to be completely allocated. Additional motivation:
IPv6 Initial motivation: 32-bit address space soon to be completely allocated. Additional motivation: header format helps speed processing/forwarding header changes to facilitate QoS IPv6 datagram format:
CS 378 (Spring 2003)
Department of Computer Sciences THE UNIVERSITY OF TEXAS AT AUSTIN CS 378 (Spring 2003) Linux Kernel Programming Yongguang Zhang (ygz@cs.utexas.edu) Copyright 2003, Yongguang Zhang This Lecture Linux Networking
Chapter 4: network layer. Network service model. Two key network-layer functions. Network layer. Input port functions. Router architecture overview
Chapter 4: chapter goals: understand principles behind services service models forwarding versus routing how a router works generalized forwarding instantiation, implementation in the Internet 4- Network
Link layer: introduction
Link layer: introduction terminology: hosts and routers: nodes communication channels that connect adjacent nodes along communication path: links wired links wireless links LANs layer-2 packet: frame,
PMSR - Poor Man s Segment Routing, a minimalistic approach to Segment Routing and a Traffic Engineering use case
PMSR - Poor Man s Segment Routing, a minimalistic approach to Segment Routing and a Traffic Engineering use case Stefano Salsano (), Luca Veltri (2), Luca Davoli (), Pier Luigi Ventre (), Giuseppe Siracusano
Network Mul,tenancy in Xen- based Clouds. Chiradeep Vi;al CloudStack Commi;er Citrix Sep
Network Mul,tenancy in Xen- based Clouds Chiradeep Vi;al CloudStack Commi;er Citrix Systems @chiradeep Sep 18 2013 Agenda Introduc,on to CloudStack Mul,- tenant IAAS Network Virtualiza,on / SDN L3 isola,on
Fundamental Questions to Answer About Computer Networking, Jan 2009 Prof. Ying-Dar Lin,
Fundamental Questions to Answer About Computer Networking, Jan 2009 Prof. Ying-Dar Lin, ydlin@cs.nctu.edu.tw Chapter 1: Introduction 1. How does Internet scale to billions of hosts? (Describe what structure
Link Layer. w/ credit to Rick Graziani (Cabrillo) for some of the anima<ons
Link Layer w/ credit to Rick Graziani (Cabrillo) for some of the anima
Software Defined Networking
Software Defined Networking Daniel Zappala CS 460 Computer Networking Brigham Young University Proliferation of Middleboxes 2/16 a router that manipulatees traffic rather than just forwarding it NAT rewrite
Chapter 4 Network Layer: The Data Plane
Chapter 4 Network Layer: The Data Plane A note on the use of these Powerpoint slides: We re making these slides freely available to all (faculty, students, readers). They re in PowerPoint form so you see
Lecture 2: Basic routing, ARP, and basic IP
Internetworking Lecture 2: Basic routing, ARP, and basic IP Literature: Forouzan, TCP/IP Protocol Suite: Ch 6-8 Basic Routing Delivery, Forwarding, and Routing of IP packets Connection-oriented vs Connectionless
Intelligent Service Function Chaining. March 2015
Intelligent Service Function Chaining March 2015 Drivers & challenges for Service Chaining 1. Easier & faster service deployment 2. Cost reduction 3. Smooth transition to the future architecture 4. Standardization
RouteBricks: Exploi2ng Parallelism to Scale So9ware Routers
RouteBricks: Exploi2ng Parallelism to Scale So9ware Routers Mihai Dobrescu and etc. SOSP 2009 Presented by Shuyi Chen Mo2va2on Router design Performance Extensibility They are compe2ng goals Hardware approach
Firewalls, VPNs, and SSL Tunnels
Chapter 20 Firewalls, VPNs, and SSL Tunnels IN THIS CHAPTER Using a packet-filtering firewall Using Squid as a firewall Using FreeS/Wan A FIREWALL IS A device that implements your security policy by shielding
Introduc8on to Computer Networks. Where we are in the Course. Network Layer Overview. Star8ng the Network Layer!
Introduc8on to Computer Networks Network Layer Overview Computer Science & Engineering Where we are in the Course Star8ng the Network Layer! Builds on the link layer. Routers send packets over mul8ple
Certification. Securing Networks
Certification Securing Networks UNIT 9 Securing Networks 1 Objectives Explain packet filtering architecture Explain primary filtering command syntax Explain Network Address Translation Provide examples
Outline. A Professional Company in Software-Defined Networking (SDN) Copyright , EstiNet Technologies Inc. All Rights Reserved..
Physical Layer Outline Signal Propagation Media The Calculation of Signal Delivery Time The Evaluation of End-to-end Delay Signal Encoding and Modulation Wired Signal s Encoding, Decoding and Decoding
User Authentication in an Internet Protocol
User Authentication in an Internet Protocol Parinya Thamthawornsakul Suvepon Sittichivapak Department of Telecommunication Engineering, King Mongkut s Institute of Technology Ladkrabang Abstract This paper
Segment Rou+ng IETF 87
Segment Rou+ng IETF 87 Clarence Filsfils cf@cisco.com C. Filsfils, S. Previdi, A. Bashandy, B. Decraene, S. Litkowski, M. Horneffer, I. Milojevic, R. Shakir, S. YP, W. Henderickx, J. Tantsura, Ericsson,
NetFPGA Hardware Architecture
NetFPGA Hardware Architecture Jeffrey Shafer Some slides adapted from Stanford NetFPGA tutorials NetFPGA http://netfpga.org 2 NetFPGA Components Virtex-II Pro 5 FPGA 53,136 logic cells 4,176 Kbit block
Juniper Netscreen Security Device. How to Enable IPv6 Page-51
Juniper Netscreen Security Device Page-51 Netscreen Firewall - Interfaces Below is a screen shot for a Netscreen Firewall interface. All interfaces have an IPv6 address except ethernet0/0. We will step
OPENSDNCORE RELEASE 4. Use cases
OPENSDNCORE RELEASE 4 Use cases AGENDA q Service Function Chaining q Tunneling with OpenSDNCore q Queues and Metering for QoS q Full Mesh Routing q Adaptive Flow Placement q Labeling q LoadBalancing 2
COMP211 Chapter 4 Network Layer: The Data Plane
COMP211 Chapter 4 Network Layer: The Data Plane All material copyright 1996-2016 J.F Kurose and K.W. Ross, All Rights Reserved Computer Networking: A Top Down Approach 7 th edition Jim Kurose, Keith Ross
Mul7cast protocols. IP Mul7cast and IGMP SRM (Scalable Reliable Mul7cast) PGM (Pragma7c General Mul7cast)
IP ANYCAST and MULTICAST; OVERLAYS and UNDERLAYS 1 IP Anycast Outline today Mul7cast protocols IP Mul7cast and IGMP SRM (Scalable Reliable Mul7cast) PGM (Pragma7c General Mul7cast) Overlay networks Tunnels
Internet Technology. 15. Things we didn t get to talk about. Paul Krzyzanowski. Rutgers University. Spring Paul Krzyzanowski
Internet Technology 15. Things we didn t get to talk about Paul Krzyzanowski Rutgers University Spring 2016 May 6, 2016 352 2013-2016 Paul Krzyzanowski 1 Load Balancers Load Balancer External network NAT
Communication System Design Projects
Communication System Design Projects KUNGLIGA TEKNISKA HÖGSKOLAN PROFESSOR: DEJAN KOSTIC TEACHING ASSISTANT: GEORGIOS KATSIKAS Traditional Vs. Modern Network Management What is Network Management (NM)?
NAT and Tunnels. Alessandro Barenghi. May 25, Dipartimento di Elettronica e Informazione Politecnico di Milano barenghi - at - elet.polimi.
NAT and Tunnels Alessandro Barenghi Dipartimento di Elettronica e Informazione Politecnico di Milano barenghi - at - elet.polimi.it May 25, 2011 Recap By now, you should be familiar with... System administration