Research on DPDK Based High-Speed Network Traffic Analysis. Zihao Wang Network & Information Center Shanghai Jiao Tong University

Transcription

1 Research on DPDK Based High-Speed Network Traffic Analysis Zihao Wang Network & Information Center Shanghai Jiao Tong University

2 Outline 1 Background 2 Overview 3 DPDK Based Traffic Analysis 4 Experiment 5 Conclusion

3 Page. 3 Usage of Traffic Business Benefit ISPs personalized advertising Performance Monitoring Security

4 Page. 4 Mainstream Traffic Analysis Method Protocol Analysis Port based method Payload based method Statistical approach based method Content Analysis

5 Page. 5 Current Packet Capture Engine Libpcap/Winpcap PF_RING Netmap

6 DPDK Framework Page. 6

7 Page. 7 Why DPDK Zero Copy Poll Mode Driver Architecture Fine Hardware Support Use Pointer As Much As Possible Easy-to-use Ring Manager Packet Forwarding Algorithm Support Native IPv6 Support

8 Traditional Capture Engine Page. 8

9 Traditional Capture Engine Page. 9

10 Page. 10 DPDK Based Traffic Analysis System Load balancing

11 Page. 11 DPDK Based Packet Capture pdump User Space

12 Page. 12 DPDK Based Packet Capture KNI User Space

13 Page. 13 DPDK Based Packet Capture Pdump Based Copied by port driver Dumped by pdump program KNI Based Copied in user space Send to kernel Dumped by pcap API

14 Page. 14 DPDK Based Packet Capture Pdump Based Easy to use Copied once KNI Based Need to create new thread Poor performance Highly customizable System API supported Recommended for bypass capture

15 Page. 15 DPDK Based Traffic Analysis System Basic Architecture

16 Page. 16 DPDK Based Packet Capture User Space

17 Page. 17 Compared with DPDK Based Packet Capture Pdump Based Slow down the main business Uncompressed file IO Copy at least once KNI Based Poor performance Using kernel protocol stack More copy operation

18 DPDK Based Packet Analysis Page. 18

19 Page. 19 DPDK Based Packet Analysis Multiple Producers Queue Flow Classification Support Highly customizable Improve CPU cache hit rate Avoid resource competition Expand support for both dimensions

20 Page. 20 Detailed Design Environment Abstraction Layer Set CPU affinity Set Hugepage Reload hardware by PMD

21 Page. 21 Detailed Design Packet Capture Layer Get device information Initialize ports RSS Producer queue Consumer queue Binding threads

22 Page. 22 Detailed Design Packet Capture Layer Initialize ports

23 Page. 23 Detailed Design Packet Processing Layer Consumer queue management Data analysis Software migration

24 Page. 24 Detailed Design Packet Processing Layer Pcap compatible

25 Page. 25 Detailed Design Packet Processing Layer IPv6 support Making use of kernel protocol stack

26 Page. 26 Detailed Design Packet Processing Layer IPv6 support Making use of kernel protocol stack

27 Page. 27 Detailed Design Packet Processing Layer IPv6 support Make use of DPDK IPv6 Support

28 Page. 28 Detailed Design Packet Processing Layer IPv6 support Make use of DPDK IPv6 Support

29 Page. 29 Performance Testing Using SJTU campus network traffic as testing background Add feature packets to the traffic Using analysis system dealing with the traffic Counting feature ones in the analysis result Comparing with the number of total feature packets, and evaluating system performance

30 Page. 30 Performance Testing The number of total feature packets is N "#$%&' The number of feature packets in the result is N $&()*+ Packet loss rate = 8 9:;<=>?8 ;=@ABC 8 9:;<=> The number of requests is N $&D)&(+ The number of requests succeed is N $&(EFG(&' N "#$%&' = N IJKLMNKJO + N $&D)&(+

31 Page. 31 Performance comparison Network Layer Analysis Input: Analyzable Packets Output: Application layer analysis result 1. Parse network layer header 2. Analysis key information and save

32 Page. 32 Performance comparison Packet loss rate DPDK libpcap PF_RING 45.00% 40.00% 39.50% 35.00% 30.00% 27.15% 25.00% 20.00% 15.00% 10.00% 4.69% 5.00% 4.09% 0.00% 0.00% 0.00% Background Traffic (Gbps) Packet loss rate 45% 40% 35% 30% 25% 20% 15% 10% 5% 0% DPDK libpcap PF_RING 40.18% 38.00% 16.06% 8.00% 0.06% 0.17% Background Traffic (Gbps)

33 Page. 33 Performance comparison Application layer Analysis Input: Analyzable Packets Output: Application layer analysis result 1. Set TCP filter 2. Parse network layer header 3. IP Reassembly 4. Parse application layer header 5. Analyze HTTP portal 6. Analyze key information and save

34 Page. 34 Performance comparison Packet loss rate DPDK libpcap PF_RING 40.00% 35.00% 33.59% 30.00% 25.00% 20.00% 15.14% 15.00% 10.00% 0.36% 0.30% 5.00% 0.00% 0.00% 0.06% 0.00% 0.17% Background Traffic (Gbps) Packet loss rate 45% 40% 35% 30% 25% 20% 15% 10% 5% 0% DPDK libpcap PF_RING 42.25% 38.40% 33.37% 19.94% 15.14% 3.18% 0.50% 0.87% 0.24% Background traffic (Gbps)

35 Page. 35 Performance comparison 2.00% Packet loss rate 1.50% 1.00% 0.50% 0.00% Cores for analysis Cores for capture 0.00%-0.50% 0.50%-1.00% 1.00%-1.50% 1.50%-2.00%

36 Page. 36 Network Traffic Analysis System Distributed storage module HDFS Put file import mount export Data temporary store locally

37 Page. 37 Network Traffic Analysis System Distributed storage module One Month IP log 3 TB 40 billion HTTP log 6 TB 20 billion DNS log 2 TB 20 billion

38 Page. 38 Network Traffic Analysis System Analysis result UI Module

39 Page. 39 Network Traffic Analysis System Analysis result UI Module

40 Thanks