Downloaded 60 times
Uploaded byHungWei Chiu
Application-Based Routing
The document discusses application-based routing in Software Defined Wide Area Network (SD-WAN) environments, detailing how to optimize traffic routes based on application priority using various Linux kernel techniques. It explains the challenges of implementing deep packet inspection (DPI) and routing decisions through methods like netfilter and iptables. The presentation emphasizes performance improvements by leveraging connection tracking and reducing the need for excessive packet inspections.
More Related Content
Similar to Application-Based Routing
![SDN Demystified, by Dean Pemberton [APNIC 38]](https://cdn.slidesharecdn.com/ss_thumbnails/sdndemystified1410925639-140917000156-phpapp02-thumbnail.jpg?width=640&height=640&fit=bounds)
Application-Based Routing
- 1. SDN X CLOUDNATIVE MEETUP #10
- 2.
- 3. WHO AM I HungWei Chiu (Hwchiu) https://blog.hwchiu.com DevOps Engineer @ ThunderToken Interest in Networking/DevOps/Kubernetes/SDN/Programming
- 4. Software Defined WideArea Network (SD-WAN)
- 5. SD-WAN Create a virtual-overlayto abstract underlying private/public WAN connections LTE MPLS Wifi Fiber Route WAN traffic along the best route Latency QoS
- 6. SD-WAN Managed by acentralized controller Remotely program edge devices and reduce provisioning times. Minimizing the need to manually configure network devices Security IPSec Firewall
- 7. SD-WAN Traffic Improve performance througha combination WAN connections Fail-over Simplifies the network Deployments Configurations Operations
- 8.
- 9.
- 10. APPLICATION-BASED ROUTING Assume there’remultiple WAN Connections Different Latency Route the traffic based on application Priority Game/VoIP/…etc
- 11. Public Internet 10 sec 2sec 3 sec500 ms
- 12. Public Internet 10 sec 2sec 3 sec500 ms File Transfer Web Browse
- 13. How Can WeImplement it In a Linux Host
- 14.
- 15. DPI Deep Packet Inspection Well-knowntuple (L3 + L4) TCP/UDP Port (53/67/80/443)
- 16. DPI L7 application Organized format Guessby pattern SSL Termination User should import a trusted CA from DPI devices
- 17. NDPI Open Source Software(OSS) Based on C++ language Support 185+ protocols
- 18. NDPI Support capture packetsby pcap Decision Tree Example (Skype)
- 19. nDPI Engine Packet PacketPacketPacket Packet Packet Packet Packet Packet Packet Packet Packet = skype Connections Results Packet = Quic Packet = Facebook
- 20. APPROACHES With Linux Kernel WithoutLinux Kernel OpenvSwitch/Openflow
- 21. SOURCE (WITH KERNEL) Usethe pcap to catch packets from a specific interface By iptables and our implemented daemon
- 22. PCAP APPROACH Implement adaemon Capture packets by libpcap Feed packets to nDPI engine to get its type
- 23.
- 24. IPTABLES APPROACH Implement adaemon Capture packets by iptables module (NFQueue) Feed packets to nDPI engine to get its type
- 25. Network Stack Application nDPI Engine User-space Kernel-space Physical libnetfilter_queue enp0s1enp0s2 wlan1 netfilter nfqueue
- 26. IPTABLES APPROACH Use netlinkto pass packets from/to user- kernel Flexible than pcap approach Iptables rules
- 27. IPTABLES APPROACH Use netlinkto pass packets from/to user- kernel Flexible than pcap approach Iptables rules
- 28. Iptables -A INPUT-j NFQUEUE --queue-num 0 Iptables -A FORWARD -j NFQUEUE --queue-num 0 Iptables -A FORWARD -i br0 -j NFQUEUE --queue- num 0
- 29. Next Challenge.. How routepacket by nDPI result?
- 30. ROUTE Tag the packetsand route by tag Open the RAW socket to transmit that packet(?)
- 31. NFQUEUE We can sendpackets back to linux kern el Via netlink It’s based on sk_buff structure
- 32. NFQUEUE We can usethe mark to represent the application ID. And then we can use that mark in the iptables to accept/drop that packet
- 33.
- 37. Network Stack Application nDPI Engine User-space Kernel-space Physical libnetfilter_queue enp0s1enp0s2 wlan1 netfilter nfqueue - Receive Packets - Detect Packet - Mark Packet and send back to Kernel Routing - Accept/Drop by mark - Route ??
- 39. Iptables -i FORWARD-m mark --mark 0x0003 -j DROP Iptables -i FORWARD -m mark --mark 0x0003 -j ACCEPT
- 40. But how touse that mark to route via different interfaces?
- 41. LINUX ROUTINGTABLE Route packetsby destination IP address in default. Policy Route Source IP address L3/L4 protocols Tos/Mark
- 42. LINUX ROUTINGTABLE Multiple Routingtable Number from 0 - 32767 (high to low) Build-in 0(local) 32766(main) 32767(default) Custom
- 43. LINUX ROUTINGTABLE echo 201hwchiu.test >> /etc/iproute2/rt_tables Use ip rule to manipulate the lookup order of tables. ip rule add fmmark 10 table 201 Ip rule add from 140.113.235.234 fwmark 25 table 202 ip rule show
- 44. LINUX ROUTINGTABLE Use iproute add to add the routing rule into table. ip route add default via 10.0.2.2 dev enp0s3 table 201
- 45. Network Stack Application nDPI Engine User-space Kernel-space Physical libnetfilter_queue enp0s1enp0s2 wlan1 netfilter nfqueue - Receive Packets - Detect Packet - Mark Packet and send back to Kernel PRDB main local default custom
- 46.
- 47.
- 48. PERFORMANCE All packets havesame l3/l4 tuple belong to same connection (mostly) We don’t need to detect all packets to know its application. Just pass the unknown connection packets to nDPI engine
- 49. PERFORMANCE Use the connmarkto set the mark to connection tracking entry. Save the mark based on its skb_buff Iptables -t mangle -j CONNMARK --save- mark
- 50.
- 51. PERFORMANCE You can alsoadd those connection tuple(l3/l4) to hardware to get the high performance Remember, only few packets need to be detected.
- 52.