This document discusses TOPGUN, a multi-terabit deep packet inspection (DPI) solution developed by BigBrother Matrix R&D. It introduces Leo Yuriev, provides information about the company, and outlines an agenda covering ethics, the purpose of DPI, how TOPGUN works, use cases, and a hacking challenge. TOPGUN aims to improve upon competitors by offering better scalability without vendor lock-in. It uses techniques like MAC rewriting, swarm intelligence, and finite state machines with replication to distribute and process workloads efficiently across commodity hardware.

1. TOPGUN
multi terabit DPI
Leo Yuriev
BigBrother Matrix R&D
;)

2. About me
Leo Yuriev
– programming for 20 years
– sometimes while hacking
leo@yuriev.ru
leonid.yuriev@billing.ru

3. BigBrother Matrix R&D is…
Solutions for telecom
Full lifecycle
≈ products serves 100M clients
≈ 1K employees
http://www.billing.ru/events/560

4. Agenda
1.
2.
3.
4.
5.
ethics and legality
why & what for ?
how does it work ?
use cases
let’s HACK ?

5. WTF DPI?
http://en.wikipedia.org/wiki/Deep_packet_inspection
network
DPI
Internet
1. raw packets, a lot of…
2. inline or on-copy
3. flow ≈ from SYN to FIN

6. ethics and legality…
DPI – is just a method, no bullshit
ethics & legality – is completely defined by a
task and purpose
peeped in the payload – got a DPI
100500+ use cases

7. TOPGUN – why & what for ?
competitors have problems
fixed scope, poor scalability
depending on a hardware,
vendor lock-in, beetles ;)

8. TOPGUN – how does it work ?
just awesome cool ;)
1. MAC rewrite + L2
2. Swarm Intelligence
3. FSM with replication

9. skeleton
1
FUSE
ACTIVE
HOT STANDBY
5
7
CONTROL PLANE
6
CONTROL PLANE
SUPERVISOR
BLADE
BLADE
BLADE
BLADE
4
BLADE
DATA PLANE
BLADE
DATA PLANE
BLADE
3
BLADE
DISTRIBUTION
BLADE
DISTRIBUTION
BLADE
2

10. workload distribution
FUSE
DISTRIBUTION
dst-MAC[0,1,2,3] = 0x77
dst-MAC[4,5] = Hash(IP)
BLADE
BLADE
BLADE
DATA PLANE
(Ethernet Switch)
BLADE
SEG #
BLADE
MAC → PORT#

11. swarm intelligence

12. swarm #1: balancing
FUSE
DISTRIBUTION
LIST
BLADE
BLADE
SEG#
BLADE
BLADE
DATA PLANE
BLADE
MAC → PORT#
MAC → PORT#
SEG#
SEG#
SEG#
SEG#
LIST
LIST
LIST
LIST
CONTROL PLANE
(Ethernet Switch)

13. swarm #2: tableau
FUSE
DISTRIBUTION
TABLEAU
replica
CONTROL PLANE
BLADE
BLADE
BLADE
BLADE
key1 = value + version
key2 = value + version
…
key# = value + version
BLADE
DATA PLANE

14. swarm #3: do it
FUSE
DISTRIBUTION
from=10.0.0.1:4629
to=199.32.42.3:80
node={A.5, Green}
…
inbound=200
outbound=6346
WRITEBACK
FIFO
TABLEAU
replica
CONTROL PLANE
BLADE
BLADE
BLADE
WORKER
BLADE
BLADE
DATA PLANE

15. TOPGUN DPI can…
Monitoring & Protection
GSM / UMTS / LTE
Control
IDS / IPS,
Transport / Signalling,
Overload
PCEF, TDF, …
QoS, Policing,
Shaping, Filtering
+100500…
Useful
Protocol Detection
Shaping
Deep Filtering
commodity
hardware
wide application
scope
extend by demand
on the fly

16. let’s be HACK us ;)
100 гигабит в один IP (кейс от Лямина)
Обмануть детектор протоколов
Обход фильтрации HTTP
Завалить фрагментацией
Завалить syn-ами
…
Ваши варианты?