Pineda Rodríguez, Alberto

ABSTRACT
This paper describes the proposal of a priority flow oriented design of the Ksensor architecture. Ksensor is a multiprocessor traffic capture and analysis system for high speed networks developed at kernel space. While the current architecture permits the capture and analysis of data flows, there are several scenarios where it does not perform adequately to achieve this goal, for example, if a certain type of traffic is more valuable than others. Thus, this work pursues the design that allows Ksensor to provide data flow treatment to a larger extent. This improvement will allow the new architecture to provide more reliability in data flow capture and processing.

ABSTRACT
Due to the fact that, nowadays, it is possible to capture traffic in 1-10 Gigabit Ethernet networks using commodity hardware, many traffic monitoring systems, and especially capturing tools, have been proposed in recent years. This paper presents a comparison between two software probes named Adviser and Ksensor. Both of them are multi-processor systems and are built over conventional hardware. However, while Adviser is designed in user space, Ksensor runs in kernel space. This work compares the performance results of the two probes considering several capture engines (NAPI, PF_RING with DNA, PFQ) and, at the same time, different application or analysis loads. The evaluations of the probes with the different settings have been performed on the same hardware multi-core configuration. The results of the evaluations let conclude which solution is better in each situation and which solution must be discarded.

ABSTRACT
Packet capturing and analysis in high-speed networks, like 1-10 Gigabit Ethernet, is a challenging task, especially when applications do not permit packet loss. In this environment, the use of multiprocessor and multicore systems, as well as the parallelization of applications, is aimed at improving the performance. However, the monitoring application may even experience performance penalties when adapted to multiprocessor architectures. After observing certain anomalies in a real traffic monitoring system that runs on a multiprocessor platform, this paper presents an analytical model for that type of systems. The model, which is based on generalized stochastic Petri nets, evaluates the efficiency of the traffic capturing and analysis system depending on the hardware/software platform features.

ABSTRACT
In NQaS, a kernel level network traffic sniffer under the name of Ksensor was created long ago. Ksensor has been using for long a kernel version which has become outdated with the pass of the years. In order to recover the relevance of the study of the sniffer and update with the latest trends in kernel efficiency, a project has been developed, in which Ksensor is adapted to get advantage of latest capture optimizations. Linux developers have created several ways to optimize the system throughput in high system load, and in the area of traffic capture, GRO and RPS mechanisms are the most important changes done.

ABSTRACT
Adviser is a user-space software which allows to capture and analyze traffic in high speed networks. This paper describes the integration of PF_RING library, kernel module and optional drivers into Adviser platform, to enhance the packet capturing. Adviser packet capturing is made through standard Linux Libpcap library and offers good performance and flexibility. PF_RING increases the packet capturing adding a new kernel module which speeds up the packet copying from kernel space to user-space. Therefore this integration will improve Adviser's traffic monitoring performance, reducing the CPU consumption in packet capturing

ABSTRACT
The aim of this paper is to describe the design of a FPGA-based traffic generator able to inject synthetic traffic at gigabit or higher rate. The proposed architecture has been designed to add new features that existing generators do not offer. The generator tries to emulate real network traffic by injecting multiple flows that follow user desired statistical distributions. It offers a generic architecture that can support various protocols. The system also keeps an accurate timing of the injection of each frame. With those features, the proposed system aims to serve as a tool for testing traffic capture systems and other network resources at stress conditions, so research teams can measure and improve the performance of those systems.

ABSTRACT
NQaS research group of the UPV/EHU focuses its activity on three main lines: the analysis of quality of service in data networks, the resource management in the distribution of multimedia content over NGN environments and the traffic analysis in high-speed networks using probes. This paper deals with the latter whose objective is to investigate the most efficient way to analyse the traffic in 1/10 Gbps or above networks with a traffic probe and to treat that data flow online. This paper shows the work that the group is developing, firstly, in the design of own software systems (Ksensor, Adviser) which are able to meet the computational needs that traffic analysis requires, secondly, in proposals for migration of certain components and logic to hardware systems based on FPGA in order to improve performance, and finally, in creating mathematical models to estimate the utilization of computational resources depending on the traffic analysis load.

ABSTRACT
Nowadays traffic monitoring is a must for manypurposes (IDS, antivirus, QoS monitoring, network problem detection, etc.) Deployment of high speed networks implies problems with these kind of systems to be able to cope with all the traffic in the network. Therefore, it would be interesting to know in advance whether our system will be able to do its task correctly, or it needs more processing power. This paper presents a simulator for network traffic capturing systems that use commodity hardware and general purpose operating systems. In order to establish the different elements of the simulator we carried out an in depth study of the network capturing subsystem in the Linux kernel. We identified the different stages of the travel of packets from wire to application, as well as the particular behavior of the system and computational cost for each one of them. With this information we have built up a model that simulates these different stages of a capturing system. This model allows us to estimate the performance a network application will be able to achieve, when packet losses will start and where they will appear.

ABSTRACT
The need to monitor and analyse network traffic grows with the deployment of new multimedia services over high speed networks. Predicting the overall capturing performance is crucial to know if the traffic monitoring system will be able to cope with all the traffic packets, or if it needs more processing power. In this paper, we present an analytical model based on a Markov chain to study the efficiency of the Linux network subsystem. Improving the capturing stage of Linux has been an extensively covered research topic in the past years. Although the majority of the proposals have been backed by experimental evaluations, there are few analytical models. We identify the softIRQ process as the main element in the Linux capturing stage and we have built a model that represents the different steps in the softIRQ and the computational cost for each one of them. The goodness of the model is checked by comparing analytical results with practical ones obtained from a real traffic monitoring system. Prior to obtaining the theoretical performance results, it is necessary to introduce some input parameters for the model. These initial necessary values are also extracted from experimental measurements, making use of an appropriate methodology. The results of all this process indicate us that the behaviour of the system performance depends on the network traffic rate and this has become our work in progress.

ABSTRACT
In traffic capturing and analysis systems, it is important to measure the performance in terms of throughput, packet loss, CPU availability, latency, interrupt frequency, etc. If these metrics are the result of theoretical assumptions, then it is necessary to validate those results by running appropriate testing. This paper presents a generic test framework composed of four elements (a manager, agents, daemons and formatters). With these four elements, every phase of the validation process is automated, from test configuration to result formatting. The architecture presented in this paper has been applied to validation tests of traffic monitoring systems devoted to high speed network traffic analysis. The performance tests have been made modifying different parameters such as packet injection rate, packet length, the number of processors on the probe, analysis load or probe’s configuration mode. In spite of having this infrastructure and configuration complexity, the deployment of this framework has led to a reduction in the time needed for the test phase and the number of errors due to mistakes.

ABSTRACT
This paper describes the research for a priority flow oriented design of the Ksensor architecture. Ksensor is a multiprocessor traffic capture and analysis system for high speed networks developed at kernel space. While the actual architecture permits the capture and analysis of data flows, there are several scenarios where it does not perform adequately to achieve this goal. For example, if a certain type of traffic is more valuable than others. Thus, this project pursues the design that allows Ksensor to provide data flow treatment to a larger extent. Allowing the new architecture to provide more reliability in data flow capture and processing.

ABSTRACT
Traffic monitoring is an increasingly important discipline for nowadays networking, as accounting, security and also Quality of Service (QoS) lay on it. Besides, traffic bandwidth has increased exponentially in the last few years, and high speed network monitoring is a challenging aim. Performance requirements are highly relevant for monitoring systems. In a previous work, our research group NQaS (Networking, Quality and Security) provided an architecture able to cope with high-speed traffic monitoring using commodity hardware. Its design was also intended to exploit the parallelism available. This paper shows the main features of this kernel-level monitoring system (ksensor) and presents an analytical model for a multiprocessor network traffic analysis system. The model which is based on Markov chains, evaluates the efficiency of the system. The goodness of the model will be checked by comparing analytical results with practical ones obtained in laboratory, using ksensor, which runs on a multiprocessor platform in the testing system.

ABSTRACT
The rate of networks is bigger all the time. Because of this increase, computational ability of network resources and principal servers could not be adequate. In order to improve the performance of this equipment traffic generators are needed. These have to generate modelled traffic flows at high rates. To do this, the system must measure short lapses of time. This paper studies how the traffic generator over GNU/Linux sends a packet. It presents some temporary parameters to define the packet sending. Some experiments have been done in order to measure those parameters. Thanks to those measurements, this paper studies how this sending is, in fact. This helps taking decisions in the final design of the traffic generator.

ABSTRACT
In the design of traffic generators time measurement is very important. When a high rate is needed time lapses between packet sending are smaller. Because of this, the granularity of the system must be good. GNU/Linux has some tools that could be very useful to implement the measure of those time lapses. In order to choose the best solution, this paper studies the different tools that are provided by GNU/Linux. This study is aimed at the design of a kernel module that works as a traffic generator. In this paper is presented a solution that uses two kinds of tools, too. In this way, the performance of the generator is better.

ABSTRACT
With the increase of the rate in networks, computational ability of network resources and principal servers could be inadequate. In order to prove the performance of networks, network resources and servers there have to be traffic generators. These generate traffic flows with different characteristics. It is also necessary to have network monitoring systems to inspect and process traffic. Doing this in high speed segments in an efficient way is not easy. This paper proposes a design of an architecture to inject traffic in a synthetic way and to improve the performance in network traffic analysis. This architecture tries to improve other solutions’ performance using a general purpose architecture under Linux over a PC with a common network interface. The basis of this improvement is including the application in the kernel of the operating system.

ABSTRACT
Con el aumento de la velocidad en las redes de datos la capacidad computacional de la infraestructura de comunicaciones y de los servidores principales puede verse comprometida. Para poder probar el rendimiento de las redes, de los equipos de interconexión y de los servidores se hace necesario disponer de sistemas de inyección de tráfico, que permitan la generación de tráfico sintético con diferentes características. También es necesario disponer de sistemas de monitorización, que permitan estudiar las características del tráfico. Hacer esto en segmentos de alta capacidad de una forma eficaz no es un asunto trivial. Este artículo propone el diseño de una arquitectura de inyección y monitorización de tráfico sintético que pretende mejorar los rendimientos de las soluciones disponibles utilizando una arquitectura de propósito general como es un sistema Linux sobre un PC con una interfaz de red común. El fundamento en la mejora de los rendimientos se basa principalmente en la introducción de la lógica de inyección y monitorización en el núcleo del sistema operativo.