Projet

Général

Profil

AtelierPPS2012 » Historique » Version 30

Laurent GUERBY, 20/06/2013 19:38

1 1 Laurent GUERBY
{{>toc}}
2 1 Laurent GUERBY
3 1 Laurent GUERBY
h1. AtelierPPS2012
4 1 Laurent GUERBY
5 1 Laurent GUERBY
Une attaque sur le réseau gitoyen a eu lieu le 18 juin et une sur tetaneutral.net le 29 juin, ces deux attaques etaient en "paquet par seconde" (PPS) avec de petits paquets de 50-60 byte qui saturent les CPU des routeurs logiciels.
6 1 Laurent GUERBY
7 1 Laurent GUERBY
L'idée est d'étudier via des recherches sur le web et des laboratoires/ateliers le comportement des routeurs logiciels dans ce cas la : limites atteintes en fonction du paramétrage et du matériel (carte réseau, CPU et fréquence).
8 1 Laurent GUERBY
9 1 Laurent GUERBY
h2. Liens
10 1 Laurent GUERBY
11 16 Laurent GUERBY
12 2 Laurent GUERBY
* http://lists.tetaneutral.net/pipermail/technique/2012-July/000406.html
13 2 Laurent GUERBY
* http://guerby.org/ftp/dos-tetaneutral-20120629-12h33-13h03-pps.png
14 24 Laurent GUERBY
* http://networkstatic.net/the-sdn-impact-on-net-neutrality/
15 16 Laurent GUERBY
* http://blog.exceliance.fr/2012/04/24/hypervisors-virtual-network-performance-comparison-from-a-virtualized-load-balancer-point-of-view/
16 3 Laurent GUERBY
* http://www.spinics.net/lists/netdev/msg206077.html
17 3 Laurent GUERBY
** So with your patch, Eric's patch, and this most recent patch we are now at 11.8Mpps with 8 or 9 queues.  At this point I am staring to hit the hardware limits since 82599 will typically max out at about 12Mpps w/ 9 queues.
18 3 Laurent GUERBY
** 12e6 * 64 byte * 8  = 6.1 Gbit/s
19 18 Laurent GUERBY
** PATCH Remove the ipv4 routing cache http://www.spinics.net/lists/netdev/msg205545.html
20 3 Laurent GUERBY
* Intel® 82599 10 Gigabit Ethernet Controller http://ark.intel.com/products/series/32609
21 4 Laurent GUERBY
* more interrupts (lower performance) in bare-metal compared with running VM https://lkml.org/lkml/2012/7/27/490
22 3 Laurent GUERBY
23 3 Laurent GUERBY
100 Mbit/s = 195312 frames de 64 byte/s
24 3 Laurent GUERBY
1000 Mbit/s = 1953125 frames de 64 byte/s
25 3 Laurent GUERBY
26 5 Laurent GUERBY
* discussion choix d'un routeur et attaque PPS : http://www.mail-archive.com/frnog@frnog.org/msg19673.html
27 10 Laurent GUERBY
* projet netmap http://info.iet.unipi.it/~luigi/netmap/
28 10 Laurent GUERBY
** http://lwn.net/Articles/484323/
29 6 Laurent GUERBY
** http://info.iet.unipi.it/~luigi/papers/20120503-netmap-atc12.pdf
30 7 Laurent GUERBY
*** "In our prototype, a single core running at 900 MHz can send or receive 14.88 Mpps (the peak packet rate on 10 Gbit/s links). This is more than 20 times faster than conventional APIs."
31 8 Laurent GUERBY
** http://info.iet.unipi.it/~luigi/netmap/20110729-rizzo-infocom.pdf
32 8 Laurent GUERBY
** VALE, a Virtual Local Ethernet http://info.iet.unipi.it/~luigi/vale/
33 1 Laurent GUERBY
*** http://info.iet.unipi.it/~luigi/papers/20120608-vale.pdf
34 1 Laurent GUERBY
*** " Our architecture, called VALE, implements a Virtual Local Ethernet that can be used by virtual machines such as QEMU, KVM and others, as well as regular processes, to achieve over 17 million packets per second (Mpps) between host processes, and over 2 Mpps between QEMU instances, without any hardware assistance"
35 1 Laurent GUERBY
** Towards a Billion Routing Lookups per Second in Software http://info.iet.unipi.it/~luigi/papers/20120601-dxr.pdf
36 13 Laurent GUERBY
** http://info.iet.unipi.it/~luigi/netmap/talk-hp.html
37 13 Laurent GUERBY
** http://marc.info/?a=133836981100006&r=1&w=4
38 14 Laurent GUERBY
** 10 Gbit/s Line Rate Packet Processing Using Commodity Hardware: Survey and new Proposals http://luca.ntop.org/10g.pdf
39 10 Laurent GUERBY
* http://www.intel.com/content/www/us/en/ethernet-controllers/82599-10-gbe-controller-datasheet.html
40 10 Laurent GUERBY
* ipfw 9-10 Mpps http://lists.freebsd.org/pipermail/freebsd-net/2012-July/032869.html
41 19 Laurent GUERBY
* projet PFQ
42 19 Laurent GUERBY
** http://netgroup.iet.unipi.it/software/pfq/index.html
43 17 Laurent GUERBY
* Ubiquity EdgeMax router
44 17 Laurent GUERBY
** http://www.ubnt.com/edgemax
45 17 Laurent GUERBY
** http://forum.ubnt.com/showthread.php?t=59312
46 17 Laurent GUERBY
** http://dl.ubnt.com/Tolly212127UbiquitiEdgeRouterLitePricePerformance.pdf
47 17 Laurent GUERBY
** http://dl.ubnt.com/Tolly212128UbiquitiEdgeRouterLitePricePerformanceVsMikroTik.pdf
48 25 Laurent GUERBY
* http://dpdk.org/
49 25 Laurent GUERBY
** Intel DPDK: Data Plane Development Kit
50 25 Laurent GUERBY
** Intel DPDK is a set of libraries and drivers for fast packet processing on x86 platforms. It runs mostly in Linux userland.
51 26 Laurent GUERBY
* http://www.slideshare.net/shemminger/uio-final
52 26 Laurent GUERBY
** Networking in Userspace : Living on the edge
53 27 Laurent GUERBY
* http://tech.slashdot.org/story/13/04/17/2014206/vint-cerf-sdn-is-a-model-for-a-better-internet
54 27 Laurent GUERBY
** http://slashdot.org/topic/datacenter/vint-cerf-sdn-is-a-model-for-a-better-internet/
55 28 Laurent GUERBY
* http://www.opendaylight.org/
56 28 Laurent GUERBY
** OpenDaylight's mission is to facilitate a community-led, industry-supported open source framework, including code and architecture, to accelerate and advance a common, robust Software-Defined Networking platform
57 10 Laurent GUERBY
58 30 Laurent GUERBY
* http://www.packetdam.com/
59 30 Laurent GUERBY
60 10 Laurent GUERBY
* http://www.cisco.com/web/partners/downloads/765/tools/quickreference/routerperformance.pdf
61 8 Laurent GUERBY
62 11 Laurent GUERBY
* http://osdir.com/ml/linux.drivers.e1000.devel/2007-05/msg00182.html
63 11 Laurent GUERBY
** "The network cards are perfectly capable of achieving much higher numbers than  135k pps. The linux network stack however is currently not."
64 11 Laurent GUERBY
* http://code.google.com/p/openpgm/
65 12 Laurent GUERBY
* http://afresh1.com/OpenBSD_49_Throughput_Latency/
66 5 Laurent GUERBY
67 20 Laurent GUERBY
* http://code.ettus.com/redmine/ettus/projects/public/wiki/Latency
68 20 Laurent GUERBY
69 21 Laurent GUERBY
* 10Gbps Open Source Routing » de Bengt Gördén, Olof Hagsand et Robert Olsson http://www.iis.se/docs/10G-OS-router_2_.pdf
70 22 Laurent GUERBY
* http://fr.slideshare.net/brouer/linuxcon2009-10gbits-bidirectional-routing-on-standard-hardware-running-linux
71 22 Laurent GUERBY
* 10 Gbit Hardware Packet Filtering Using Commodity Network Adapters http://ripe61.ripe.net/presentations/138-Deri_RIPE_61.pdf
72 23 Laurent GUERBY
* https://wiki.freebsd.org/NetworkPerformanceTuning
73 21 Laurent GUERBY
74 29 Laurent GUERBY
*  http://wiki.networksecuritytoolkit.org/nstwiki/index.php/LAN_Ethernet_Maximum_Rates,_Generation,_Capturing_%26_Monitoring
75 29 Laurent GUERBY
* http://www.cisco.com/web/about/security/intelligence/network_performance_metrics.html
76 29 Laurent GUERBY
77 1 Laurent GUERBY
h2. Personnes interessées
78 1 Laurent GUERBY
79 1 Laurent GUERBY
# Laurent GUERBY
80 15 Julien Aubé
# Obinou (qui a déjà utilisé PF-RING et NTOP)
81 1 Laurent GUERBY
82 1 Laurent GUERBY
A priori il suffit de deux machines pour pouvoir commencer chez soi.
83 11 Laurent GUERBY
84 11 Laurent GUERBY
h2. Tests
85 11 Laurent GUERBY
86 11 Laurent GUERBY
e1000e D2500CC (squeeze) et core i5 DQ67SW (squeeze + kernel 3.2bpo)
87 11 Laurent GUERBY
iperf plafonne a 120-130k pps