Projet

Général

Profil

AtelierPPS2012 » Historique » Version 34

Laurent GUERBY, 28/12/2013 12:52

1 1 Laurent GUERBY
{{>toc}}
2 1 Laurent GUERBY
3 1 Laurent GUERBY
h1. AtelierPPS2012
4 1 Laurent GUERBY
5 32 Laurent GUERBY
Une attaque sur le réseau gitoyen a eu lieu le 18 juin et une sur tetaneutral.net le 29 juin, ces deux attaques etaient en "paquet par seconde" (PPS) avec de petits paquets de 50-60 byte qui saturent les CPU des routeurs logiciels.
6 1 Laurent GUERBY
7 32 Laurent GUERBY
L'idée est d'étudier via des recherches sur le web et des laboratoires/ateliers le comportement des routeurs logiciels dans ce cas la : limites atteintes en fonction du paramétrage et du matériel (carte réseau, CPU et fréquence).
8 1 Laurent GUERBY
9 1 Laurent GUERBY
h2. Liens
10 1 Laurent GUERBY
11 16 Laurent GUERBY
12 2 Laurent GUERBY
* http://lists.tetaneutral.net/pipermail/technique/2012-July/000406.html
13 2 Laurent GUERBY
* http://guerby.org/ftp/dos-tetaneutral-20120629-12h33-13h03-pps.png
14 24 Laurent GUERBY
* http://networkstatic.net/the-sdn-impact-on-net-neutrality/
15 16 Laurent GUERBY
* http://blog.exceliance.fr/2012/04/24/hypervisors-virtual-network-performance-comparison-from-a-virtualized-load-balancer-point-of-view/
16 3 Laurent GUERBY
* http://www.spinics.net/lists/netdev/msg206077.html
17 3 Laurent GUERBY
** So with your patch, Eric's patch, and this most recent patch we are now at 11.8Mpps with 8 or 9 queues.  At this point I am staring to hit the hardware limits since 82599 will typically max out at about 12Mpps w/ 9 queues.
18 3 Laurent GUERBY
** 12e6 * 64 byte * 8  = 6.1 Gbit/s
19 18 Laurent GUERBY
** PATCH Remove the ipv4 routing cache http://www.spinics.net/lists/netdev/msg205545.html
20 32 Laurent GUERBY
* Intel® 82599 10 Gigabit Ethernet Controller http://ark.intel.com/products/series/32609
21 4 Laurent GUERBY
* more interrupts (lower performance) in bare-metal compared with running VM https://lkml.org/lkml/2012/7/27/490
22 3 Laurent GUERBY
23 3 Laurent GUERBY
100 Mbit/s = 195312 frames de 64 byte/s
24 3 Laurent GUERBY
1000 Mbit/s = 1953125 frames de 64 byte/s
25 31 Laurent GUERBY
* http://dpdk.org/ml/archives/dev/2013-May/000102.html
26 31 Laurent GUERBY
** In case of 64 byte packets (with Ethernet CRC), (64+20)*8 = 672 bits. So line rate is 10000/672 = 14.88 Mpps.
27 5 Laurent GUERBY
* discussion choix d'un routeur et attaque PPS : http://www.mail-archive.com/frnog@frnog.org/msg19673.html
28 10 Laurent GUERBY
* projet netmap http://info.iet.unipi.it/~luigi/netmap/
29 10 Laurent GUERBY
** http://lwn.net/Articles/484323/
30 6 Laurent GUERBY
** http://info.iet.unipi.it/~luigi/papers/20120503-netmap-atc12.pdf
31 7 Laurent GUERBY
*** "In our prototype, a single core running at 900 MHz can send or receive 14.88 Mpps (the peak packet rate on 10 Gbit/s links). This is more than 20 times faster than conventional APIs."
32 8 Laurent GUERBY
** http://info.iet.unipi.it/~luigi/netmap/20110729-rizzo-infocom.pdf
33 8 Laurent GUERBY
** VALE, a Virtual Local Ethernet http://info.iet.unipi.it/~luigi/vale/
34 1 Laurent GUERBY
*** http://info.iet.unipi.it/~luigi/papers/20120608-vale.pdf
35 1 Laurent GUERBY
*** " Our architecture, called VALE, implements a Virtual Local Ethernet that can be used by virtual machines such as QEMU, KVM and others, as well as regular processes, to achieve over 17 million packets per second (Mpps) between host processes, and over 2 Mpps between QEMU instances, without any hardware assistance"
36 1 Laurent GUERBY
** Towards a Billion Routing Lookups per Second in Software http://info.iet.unipi.it/~luigi/papers/20120601-dxr.pdf
37 13 Laurent GUERBY
** http://info.iet.unipi.it/~luigi/netmap/talk-hp.html
38 13 Laurent GUERBY
** http://marc.info/?a=133836981100006&r=1&w=4
39 14 Laurent GUERBY
** 10 Gbit/s Line Rate Packet Processing Using Commodity Hardware: Survey and new Proposals http://luca.ntop.org/10g.pdf
40 10 Laurent GUERBY
* http://www.intel.com/content/www/us/en/ethernet-controllers/82599-10-gbe-controller-datasheet.html
41 10 Laurent GUERBY
* ipfw 9-10 Mpps http://lists.freebsd.org/pipermail/freebsd-net/2012-July/032869.html
42 19 Laurent GUERBY
* projet PFQ
43 19 Laurent GUERBY
** http://netgroup.iet.unipi.it/software/pfq/index.html
44 17 Laurent GUERBY
* Ubiquity EdgeMax router
45 17 Laurent GUERBY
** http://www.ubnt.com/edgemax
46 17 Laurent GUERBY
** http://forum.ubnt.com/showthread.php?t=59312
47 17 Laurent GUERBY
** http://dl.ubnt.com/Tolly212127UbiquitiEdgeRouterLitePricePerformance.pdf
48 17 Laurent GUERBY
** http://dl.ubnt.com/Tolly212128UbiquitiEdgeRouterLitePricePerformanceVsMikroTik.pdf
49 25 Laurent GUERBY
* http://dpdk.org/
50 25 Laurent GUERBY
** Intel DPDK: Data Plane Development Kit
51 25 Laurent GUERBY
** Intel DPDK is a set of libraries and drivers for fast packet processing on x86 platforms. It runs mostly in Linux userland.
52 26 Laurent GUERBY
* http://www.slideshare.net/shemminger/uio-final
53 26 Laurent GUERBY
** Networking in Userspace : Living on the edge
54 27 Laurent GUERBY
* http://tech.slashdot.org/story/13/04/17/2014206/vint-cerf-sdn-is-a-model-for-a-better-internet
55 27 Laurent GUERBY
** http://slashdot.org/topic/datacenter/vint-cerf-sdn-is-a-model-for-a-better-internet/
56 28 Laurent GUERBY
* http://www.opendaylight.org/
57 28 Laurent GUERBY
** OpenDaylight's mission is to facilitate a community-led, industry-supported open source framework, including code and architecture, to accelerate and advance a common, robust Software-Defined Networking platform
58 10 Laurent GUERBY
59 30 Laurent GUERBY
* http://www.packetdam.com/
60 30 Laurent GUERBY
61 10 Laurent GUERBY
* http://www.cisco.com/web/partners/downloads/765/tools/quickreference/routerperformance.pdf
62 8 Laurent GUERBY
63 11 Laurent GUERBY
* http://osdir.com/ml/linux.drivers.e1000.devel/2007-05/msg00182.html
64 11 Laurent GUERBY
** "The network cards are perfectly capable of achieving much higher numbers than  135k pps. The linux network stack however is currently not."
65 11 Laurent GUERBY
* http://code.google.com/p/openpgm/
66 12 Laurent GUERBY
* http://afresh1.com/OpenBSD_49_Throughput_Latency/
67 5 Laurent GUERBY
68 20 Laurent GUERBY
* http://code.ettus.com/redmine/ettus/projects/public/wiki/Latency
69 20 Laurent GUERBY
70 32 Laurent GUERBY
* 10Gbps Open Source Routing » de Bengt Gördén, Olof Hagsand et Robert Olsson http://www.iis.se/docs/10G-OS-router_2_.pdf
71 22 Laurent GUERBY
* http://fr.slideshare.net/brouer/linuxcon2009-10gbits-bidirectional-routing-on-standard-hardware-running-linux
72 22 Laurent GUERBY
* 10 Gbit Hardware Packet Filtering Using Commodity Network Adapters http://ripe61.ripe.net/presentations/138-Deri_RIPE_61.pdf
73 23 Laurent GUERBY
* https://wiki.freebsd.org/NetworkPerformanceTuning
74 1 Laurent GUERBY
75 21 Laurent GUERBY
*  http://wiki.networksecuritytoolkit.org/nstwiki/index.php/LAN_Ethernet_Maximum_Rates,_Generation,_Capturing_%26_Monitoring
76 1 Laurent GUERBY
* http://www.cisco.com/web/about/security/intelligence/network_performance_metrics.html
77 1 Laurent GUERBY
78 32 Laurent GUERBY
* http://blog.erratasec.com/2013/12/ccc-100-gbps-and-your-own-private-shodan.html
79 33 Laurent GUERBY
* https://github.com/robertdavidgraham/masscan
80 32 Laurent GUERBY
* http://www.ntop.org/products/pf_ring/
81 29 Laurent GUERBY
82 34 Laurent GUERBY
* http://routebricks.org/pubs.html
83 34 Laurent GUERBY
84 32 Laurent GUERBY
h2. Personnes interessées
85 32 Laurent GUERBY
86 1 Laurent GUERBY
# Laurent GUERBY
87 32 Laurent GUERBY
# Obinou (qui a déjà utilisé PF-RING et NTOP)
88 1 Laurent GUERBY
89 1 Laurent GUERBY
A priori il suffit de deux machines pour pouvoir commencer chez soi.
90 11 Laurent GUERBY
91 11 Laurent GUERBY
h2. Tests
92 11 Laurent GUERBY
93 11 Laurent GUERBY
e1000e D2500CC (squeeze) et core i5 DQ67SW (squeeze + kernel 3.2bpo)
94 11 Laurent GUERBY
iperf plafonne a 120-130k pps