Research on DPDK Based High-Speed Network Traffic Analysis Zihao Wang Network & Information Center Shanghai Jiao Tong University
Outline 1 Background 2 Overview 3 DPDK Based Traffic Analysis 4 Experiment 5 Conclusion
Page. 3 Usage of Traffic Business Benefit ISPs personalized advertising Performance Monitoring Security
Page. 4 Mainstream Traffic Analysis Method Protocol Analysis Port based method Payload based method Statistical approach based method Content Analysis
Page. 5 Current Packet Capture Engine Libpcap/Winpcap PF_RING Netmap
DPDK Framework Page. 6
Page. 7 Why DPDK Zero Copy Poll Mode Driver Architecture Fine Hardware Support Use Pointer As Much As Possible Easy-to-use Ring Manager Packet Forwarding Algorithm Support Native IPv6 Support
Traditional Capture Engine Page. 8
Traditional Capture Engine Page. 9
Page. 10 DPDK Based Traffic Analysis System Load balancing
Page. 11 DPDK Based Packet Capture pdump User Space
Page. 12 DPDK Based Packet Capture KNI User Space
Page. 13 DPDK Based Packet Capture Pdump Based Copied by port driver Dumped by pdump program KNI Based Copied in user space Send to kernel Dumped by pcap API
Page. 14 DPDK Based Packet Capture Pdump Based Easy to use Copied once KNI Based Need to create new thread Poor performance Highly customizable System API supported Recommended for bypass capture
Page. 15 DPDK Based Traffic Analysis System Basic Architecture
Page. 16 DPDK Based Packet Capture User Space
Page. 17 Compared with DPDK Based Packet Capture Pdump Based Slow down the main business Uncompressed file IO Copy at least once KNI Based Poor performance Using kernel protocol stack More copy operation
DPDK Based Packet Analysis Page. 18
Page. 19 DPDK Based Packet Analysis Multiple Producers Queue Flow Classification Support Highly customizable Improve CPU cache hit rate Avoid resource competition Expand support for both dimensions
Page. 20 Detailed Design Environment Abstraction Layer Set CPU affinity Set Hugepage Reload hardware by PMD
Page. 21 Detailed Design Packet Capture Layer Get device information Initialize ports RSS Producer queue Consumer queue Binding threads
Page. 22 Detailed Design Packet Capture Layer Initialize ports
Page. 23 Detailed Design Packet Processing Layer Consumer queue management Data analysis Software migration
Page. 24 Detailed Design Packet Processing Layer Pcap compatible
Page. 25 Detailed Design Packet Processing Layer IPv6 support Making use of kernel protocol stack
Page. 26 Detailed Design Packet Processing Layer IPv6 support Making use of kernel protocol stack
Page. 27 Detailed Design Packet Processing Layer IPv6 support Make use of DPDK IPv6 Support
Page. 28 Detailed Design Packet Processing Layer IPv6 support Make use of DPDK IPv6 Support
Page. 29 Performance Testing Using SJTU campus network traffic as testing background Add feature packets to the traffic Using analysis system dealing with the traffic Counting feature ones in the analysis result Comparing with the number of total feature packets, and evaluating system performance
Page. 30 Performance Testing The number of total feature packets is N "#$%&' The number of feature packets in the result is N $&()*+ Packet loss rate = 8 9:;<=>?8 ;=@ABC 8 9:;<=> The number of requests is N $&D)&(+ The number of requests succeed is N $&(EFG(&' N "#$%&' = N IJKLMNKJO + N $&D)&(+
Page. 31 Performance comparison Network Layer Analysis Input: Analyzable Packets Output: Application layer analysis result 1. Parse network layer header 2. Analysis key information and save
Page. 32 Performance comparison Packet loss rate DPDK libpcap PF_RING 45.00% 40.00% 39.50% 35.00% 30.00% 27.15% 25.00% 20.00% 15.00% 10.00% 4.69% 5.00% 4.09% 0.00% 0.00% 0.00% 7 8 9 Background Traffic (Gbps) Packet loss rate 45% 40% 35% 30% 25% 20% 15% 10% 5% 0% DPDK libpcap PF_RING 40.18% 38.00% 16.06% 8.00% 0.06% 0.17% 12 13 14 15 Background Traffic (Gbps)
Page. 33 Performance comparison Application layer Analysis Input: Analyzable Packets Output: Application layer analysis result 1. Set TCP filter 2. Parse network layer header 3. IP Reassembly 4. Parse application layer header 5. Analyze HTTP portal 6. Analyze key information and save
Page. 34 Performance comparison Packet loss rate DPDK libpcap PF_RING 40.00% 35.00% 33.59% 30.00% 25.00% 20.00% 15.14% 15.00% 10.00% 0.36% 0.30% 5.00% 0.00% 0.00% 0.06% 0.00% 0.17% 6 7 8 9 Background Traffic (Gbps) Packet loss rate 45% 40% 35% 30% 25% 20% 15% 10% 5% 0% DPDK libpcap PF_RING 42.25% 38.40% 33.37% 19.94% 15.14% 3.18% 0.50% 0.87% 0.24% 12 13 14 15 16 17 Background traffic (Gbps)
Page. 35 Performance comparison 2.00% Packet loss rate 1.50% 1.00% 0.50% 0.00% 1 2 3 4 5 6 1 2 3 4 5 6 8 7 Cores for analysis Cores for capture 0.00%-0.50% 0.50%-1.00% 1.00%-1.50% 1.50%-2.00%
Page. 36 Network Traffic Analysis System Distributed storage module HDFS Put file import mount export Data temporary store locally
Page. 37 Network Traffic Analysis System Distributed storage module One Month IP log 3 TB 40 billion HTTP log 6 TB 20 billion DNS log 2 TB 20 billion
Page. 38 Network Traffic Analysis System Analysis result UI Module
Page. 39 Network Traffic Analysis System Analysis result UI Module
Thanks