Projet

Général

Profil

AtelierPPS2012 » Historique » Version 36

Laurent GUERBY, 11/01/2014 11:02

1 1 Laurent GUERBY
{{>toc}}
2 1 Laurent GUERBY
3 1 Laurent GUERBY
h1. AtelierPPS2012
4 1 Laurent GUERBY
5 32 Laurent GUERBY
Une attaque sur le réseau gitoyen a eu lieu le 18 juin et une sur tetaneutral.net le 29 juin, ces deux attaques etaient en "paquet par seconde" (PPS) avec de petits paquets de 50-60 byte qui saturent les CPU des routeurs logiciels.
6 1 Laurent GUERBY
7 32 Laurent GUERBY
L'idée est d'étudier via des recherches sur le web et des laboratoires/ateliers le comportement des routeurs logiciels dans ce cas la : limites atteintes en fonction du paramétrage et du matériel (carte réseau, CPU et fréquence).
8 1 Laurent GUERBY
9 1 Laurent GUERBY
h2. Liens
10 1 Laurent GUERBY
11 16 Laurent GUERBY
12 2 Laurent GUERBY
* http://lists.tetaneutral.net/pipermail/technique/2012-July/000406.html
13 2 Laurent GUERBY
* http://guerby.org/ftp/dos-tetaneutral-20120629-12h33-13h03-pps.png
14 24 Laurent GUERBY
* http://networkstatic.net/the-sdn-impact-on-net-neutrality/
15 16 Laurent GUERBY
* http://blog.exceliance.fr/2012/04/24/hypervisors-virtual-network-performance-comparison-from-a-virtualized-load-balancer-point-of-view/
16 3 Laurent GUERBY
* http://www.spinics.net/lists/netdev/msg206077.html
17 3 Laurent GUERBY
** So with your patch, Eric's patch, and this most recent patch we are now at 11.8Mpps with 8 or 9 queues.  At this point I am staring to hit the hardware limits since 82599 will typically max out at about 12Mpps w/ 9 queues.
18 3 Laurent GUERBY
** 12e6 * 64 byte * 8  = 6.1 Gbit/s
19 18 Laurent GUERBY
** PATCH Remove the ipv4 routing cache http://www.spinics.net/lists/netdev/msg205545.html
20 32 Laurent GUERBY
* Intel® 82599 10 Gigabit Ethernet Controller http://ark.intel.com/products/series/32609
21 4 Laurent GUERBY
* more interrupts (lower performance) in bare-metal compared with running VM https://lkml.org/lkml/2012/7/27/490
22 3 Laurent GUERBY
23 3 Laurent GUERBY
100 Mbit/s = 195312 frames de 64 byte/s
24 3 Laurent GUERBY
1000 Mbit/s = 1953125 frames de 64 byte/s
25 31 Laurent GUERBY
* http://dpdk.org/ml/archives/dev/2013-May/000102.html
26 31 Laurent GUERBY
** In case of 64 byte packets (with Ethernet CRC), (64+20)*8 = 672 bits. So line rate is 10000/672 = 14.88 Mpps.
27 35 Laurent GUERBY
* http://www.intel.com/content/www/us/en/intelligent-systems/intel-technology/packet-processing-is-enhanced-with-software-from-intel-dpdk.html
28 35 Laurent GUERBY
** 80 Mpps par processeur Xeon
29 35 Laurent GUERBY
** http://www.intel.com/content/www/us/en/communications/communications-packet-processing-brief.html
30 5 Laurent GUERBY
* discussion choix d'un routeur et attaque PPS : http://www.mail-archive.com/frnog@frnog.org/msg19673.html
31 10 Laurent GUERBY
* projet netmap http://info.iet.unipi.it/~luigi/netmap/
32 10 Laurent GUERBY
** http://lwn.net/Articles/484323/
33 6 Laurent GUERBY
** http://info.iet.unipi.it/~luigi/papers/20120503-netmap-atc12.pdf
34 7 Laurent GUERBY
*** "In our prototype, a single core running at 900 MHz can send or receive 14.88 Mpps (the peak packet rate on 10 Gbit/s links). This is more than 20 times faster than conventional APIs."
35 8 Laurent GUERBY
** http://info.iet.unipi.it/~luigi/netmap/20110729-rizzo-infocom.pdf
36 8 Laurent GUERBY
** VALE, a Virtual Local Ethernet http://info.iet.unipi.it/~luigi/vale/
37 1 Laurent GUERBY
*** http://info.iet.unipi.it/~luigi/papers/20120608-vale.pdf
38 1 Laurent GUERBY
*** " Our architecture, called VALE, implements a Virtual Local Ethernet that can be used by virtual machines such as QEMU, KVM and others, as well as regular processes, to achieve over 17 million packets per second (Mpps) between host processes, and over 2 Mpps between QEMU instances, without any hardware assistance"
39 1 Laurent GUERBY
** Towards a Billion Routing Lookups per Second in Software http://info.iet.unipi.it/~luigi/papers/20120601-dxr.pdf
40 13 Laurent GUERBY
** http://info.iet.unipi.it/~luigi/netmap/talk-hp.html
41 13 Laurent GUERBY
** http://marc.info/?a=133836981100006&r=1&w=4
42 14 Laurent GUERBY
** 10 Gbit/s Line Rate Packet Processing Using Commodity Hardware: Survey and new Proposals http://luca.ntop.org/10g.pdf
43 10 Laurent GUERBY
* http://www.intel.com/content/www/us/en/ethernet-controllers/82599-10-gbe-controller-datasheet.html
44 10 Laurent GUERBY
* ipfw 9-10 Mpps http://lists.freebsd.org/pipermail/freebsd-net/2012-July/032869.html
45 19 Laurent GUERBY
* projet PFQ
46 19 Laurent GUERBY
** http://netgroup.iet.unipi.it/software/pfq/index.html
47 17 Laurent GUERBY
* Ubiquity EdgeMax router
48 17 Laurent GUERBY
** http://www.ubnt.com/edgemax
49 17 Laurent GUERBY
** http://forum.ubnt.com/showthread.php?t=59312
50 17 Laurent GUERBY
** http://dl.ubnt.com/Tolly212127UbiquitiEdgeRouterLitePricePerformance.pdf
51 17 Laurent GUERBY
** http://dl.ubnt.com/Tolly212128UbiquitiEdgeRouterLitePricePerformanceVsMikroTik.pdf
52 25 Laurent GUERBY
* http://dpdk.org/
53 25 Laurent GUERBY
** Intel DPDK: Data Plane Development Kit
54 25 Laurent GUERBY
** Intel DPDK is a set of libraries and drivers for fast packet processing on x86 platforms. It runs mostly in Linux userland.
55 26 Laurent GUERBY
* http://www.slideshare.net/shemminger/uio-final
56 26 Laurent GUERBY
** Networking in Userspace : Living on the edge
57 27 Laurent GUERBY
* http://tech.slashdot.org/story/13/04/17/2014206/vint-cerf-sdn-is-a-model-for-a-better-internet
58 27 Laurent GUERBY
** http://slashdot.org/topic/datacenter/vint-cerf-sdn-is-a-model-for-a-better-internet/
59 28 Laurent GUERBY
* http://www.opendaylight.org/
60 28 Laurent GUERBY
** OpenDaylight's mission is to facilitate a community-led, industry-supported open source framework, including code and architecture, to accelerate and advance a common, robust Software-Defined Networking platform
61 10 Laurent GUERBY
62 30 Laurent GUERBY
* http://www.packetdam.com/
63 30 Laurent GUERBY
64 10 Laurent GUERBY
* http://www.cisco.com/web/partners/downloads/765/tools/quickreference/routerperformance.pdf
65 8 Laurent GUERBY
66 11 Laurent GUERBY
* http://osdir.com/ml/linux.drivers.e1000.devel/2007-05/msg00182.html
67 11 Laurent GUERBY
** "The network cards are perfectly capable of achieving much higher numbers than  135k pps. The linux network stack however is currently not."
68 11 Laurent GUERBY
* http://code.google.com/p/openpgm/
69 12 Laurent GUERBY
* http://afresh1.com/OpenBSD_49_Throughput_Latency/
70 5 Laurent GUERBY
71 20 Laurent GUERBY
* http://code.ettus.com/redmine/ettus/projects/public/wiki/Latency
72 20 Laurent GUERBY
73 32 Laurent GUERBY
* 10Gbps Open Source Routing » de Bengt Gördén, Olof Hagsand et Robert Olsson http://www.iis.se/docs/10G-OS-router_2_.pdf
74 22 Laurent GUERBY
* http://fr.slideshare.net/brouer/linuxcon2009-10gbits-bidirectional-routing-on-standard-hardware-running-linux
75 22 Laurent GUERBY
* 10 Gbit Hardware Packet Filtering Using Commodity Network Adapters http://ripe61.ripe.net/presentations/138-Deri_RIPE_61.pdf
76 23 Laurent GUERBY
* https://wiki.freebsd.org/NetworkPerformanceTuning
77 1 Laurent GUERBY
78 21 Laurent GUERBY
*  http://wiki.networksecuritytoolkit.org/nstwiki/index.php/LAN_Ethernet_Maximum_Rates,_Generation,_Capturing_%26_Monitoring
79 1 Laurent GUERBY
* http://www.cisco.com/web/about/security/intelligence/network_performance_metrics.html
80 1 Laurent GUERBY
81 32 Laurent GUERBY
* http://blog.erratasec.com/2013/12/ccc-100-gbps-and-your-own-private-shodan.html
82 33 Laurent GUERBY
* https://github.com/robertdavidgraham/masscan
83 32 Laurent GUERBY
* http://www.ntop.org/products/pf_ring/
84 29 Laurent GUERBY
85 34 Laurent GUERBY
* http://routebricks.org/pubs.html
86 34 Laurent GUERBY
87 36 Laurent GUERBY
* http://lwn.net/Articles/542643/
88 36 Laurent GUERBY
** Chelsio's T5 asic moves the architecture into 40GbE speeds. T5 is a 10/40GbE controller with full offload support of a complete Unified Wire solution comprising NIC, Virtualization, TOE, iWARP RDMA and FCoE.
89 36 Laurent GUERBY
** http://dpdk.org/ml/archives/dev/2014-January/001111.html fix atomic and out of order	execution
90 36 Laurent GUERBY
91 32 Laurent GUERBY
h2. Personnes interessées
92 32 Laurent GUERBY
93 1 Laurent GUERBY
# Laurent GUERBY
94 32 Laurent GUERBY
# Obinou (qui a déjà utilisé PF-RING et NTOP)
95 1 Laurent GUERBY
96 1 Laurent GUERBY
A priori il suffit de deux machines pour pouvoir commencer chez soi.
97 11 Laurent GUERBY
98 11 Laurent GUERBY
h2. Tests
99 11 Laurent GUERBY
100 11 Laurent GUERBY
e1000e D2500CC (squeeze) et core i5 DQ67SW (squeeze + kernel 3.2bpo)
101 11 Laurent GUERBY
iperf plafonne a 120-130k pps