Citation Context

... garbage collected to weed out the old traffic streams. In the next version of Argos we capture traffic using the home-grown FFPF framework which allows us to dump different flows in different traces =-=[6]-=-. The collected network traces are first preprocessed by reassembling TCP streams to formulate a continuous picture of the data sent to the guest. For stream reassembly we build on the open source eth...

Citation Context

...packet processing in the fast path with minimal host involvement, previous work has also used them in a collaborative manner with hosts, to extend host capabilities, such as for fast packet filtering =-=[14]-=-. We use the NP in a similar fashion to implement the self-virtualized network interface. Application-specific code deployment on NPs and other specialized cores has been the subject of substantial pr...

Citation Context

... type-safe language backend is developed. Many packet filtering languages have been developed to specify rules for detecting patterns in network traffic, such as BPF [36]sand the more extensible FFPF =-=[8]-=-. An early stub-compiler was USC [41] which provided an extended form of ANSI C to succinctly describe low-level heard formats and generate near-optimal C code to parse them. More recently, Pang et al...

Citation Context

...ve multiple such IO ports. The architecture that is used to place, connect, instantiate and run FEs is known as Streamline, a complete overhaul of its predecessor, the fairly fast packet filter (FFPF =-=[28]-=-). Streamline extends FFPF in many ways, for instance by adding stream reassembly, distributed processing, packet mangling and forwarding.sFig. 1. Functional architecture of the intrusion prevention s...

Citation Context

...f suspicious hosts for deep inspection. As the de facto packet filter on modern UNIX variants, BPF has shown insufficiency in handling both static and dynamic filtering tasks, particularly the latter =-=[4, 7, 10]-=-. A filter update in BPF must undergo three “pre-processing” phases: compilation, user–kernel copying, and security checking. In the compilation phase, the filtering criteria specified by the human-or...

Citation Context

...to attach to them. We discuss this in more detail in Section IV-C. A. Trustworthy Shared Memory Channels Shared memory has been used for efficient IPC for a long time [12] and in many scenarios [11], =-=[6]-=-, [10], [27]. The question we address here is whether we can use it as a trusted communication channel without harming dependability. Kernel-level IPC guarantees that a destination process is reliably...

Citation Context

...ecifically designed for packet processing at high speeds by sharing the workload between a number of independent RISC processors. However, for very demanding applications (e.g., payload scanning for worm signatures) more power is needed than any one processor can offer. For reasons of cost-efficiency it is infeasible to develop NPs that can cope with backbone link rates for such applications. An attractive alternative is to increase scalability by exploiting parallelism at a coarser granularity. We have previously introduced an efficient monitoring framework, Fairly Fast Packet Filters (FFPF) [1], that can reach high speeds by pushing as much of the work as possible to the lowest levels of the processing stack. The NIC-FIX architecture [2] showed how this monitoring framework could be extended all the way down to the network card. To support such an extensible programmable environment, we introduced the special purpose FPL-2 language. In this paper, we exploit packet processing parallelism at the level of individual processing units (NPs or commodity PCs) to build a heterogeneous distributed monitoring architecture: NET-FFPF. Incoming traffic is divided into multiple streams, each of ...

Citation Context

...alized packet processing programs. In our solution, the code generation process is decoupled from the knowledge of the format of protocol headers, which resides in an external NetPDL database. In particular, NetPDL protocol descriptions are translated into programs that implement high level filtering rules expressed in the Network Packet Filtering Language (NetPFL). This work focuses on the implementation of a compiler for packet filters; hence it does not intend to propose a new packet filtering model in competition with other well known solutions such as the BPF [7], or the more recent FFPF [8]. Indeed, we argue that packet filtering functionalities provide the basic blocks for building complete protocol-agnostic applications because they can be easily extended in order to support more complex operations, like field extraction and more. This paper is structured as follows. Section II provides an overview on the basic building blocks that represents the foundation of this work. An algorithm for the dynamic generation of packet filtering programs from NetPDL protocol descriptions is presented in Section III, while Section IV discusses its implementation in a compiler. The performances...

Citation Context

...g abstraction over a cluster of heterogeneous compute nodes: DryandLINQ can use only CPUs. Dandelion’s support for caching of intermediate data in RAM is similar to the RDDs used in Spark [103]. FFPF =-=[20]-=- provides support for compiling code written in different languages such as FPL [32, 31] and Ruler [54] to heterogeneous targets, composing the result in a graph-like structure. Dandelion shares many ...

Citation Context

...modified accordingly. For example, the kernel scheduler will have to ensure that the user-mode task controlling a NIC is scheduled sufficient CPU time and is not preempted for long continuous periods =-=[19, 25]-=- of time, or packets may be dropped (when the DMA rings fill up). Moreover, current OSes lack support for delivering events to user-space in a timely fashion—mechanisms like epoll or kqueue / kevent d...