Presented at Student Seminar Series_VIT University

1. TANMAY SINHA
B.TECH(Computer Science)
IIIrd year

2. Agenda
 PART 1
 Motivating Examples
 Generic Architecture Design
 PART 2
 Libraries you can work with
 PART 3
 Loopholes and Improvements
 Demos

3. Motivating Examples

5. (Sniffer and ID/PS
Mode)

6. Generic BPF Architecture

7. ???
???

9. Libraries
• Provisions that a packet filter can provide
 1)Monitoring
 2)Filtering
 3)Specifying Verdict on packets
 Need some High Level API’s to provide an interface
 Popular Libraries –
 Libipq()
 Libpcap()/Winpcap()

11. Libpcap()

12. Requirement-Deep Filtering

13. Libipq()

14. Loopholes
 Dynamic Filtering Tasks
 Algorithmic Inefficiency(Many pre-processing
phases)
 Architecture and Instruction Set(RISC)
 Frame Loss(Queue Overrun)

15. Solution Approaches
 Hardware level /Kernel Level/User Level
 Aim
 Reducing the number of packets that are forwarded to the application to be
only discarded later on.
 Constant memory consumption
regardless of the number of filters
 A simpler computational model with fewer instructions -->Main aim is to
achieve low filter update latency by avoiding filter recompilation
 A modified implementation of the Netfilter ip_queue module with the
goal of higher performance
 Allowing packets on a single interface to be segmented across multiple
threads/cores, allowing for more efficient packet processing

16. Technicalities
 To interrogate Queue status
 #ethtool -S ethX
 To increase Queue Length
 # ethtool --set-ring ethX [rx N] [tx N]
 To increase rate at which Queue Drains
 # vim /proc/sys/net/core/dev_weight
 Slow down i/p traffic by controlling size of receive buffers
used in Sockets
 #sysctl -w net.core.rmem_default=N

17. Solution Approaches…contd
 BLOOM FILTERS
 A probabilistic data structure that is used to test whether an
element is a member of a set. False positives are possible, but
False Negatives are not
 Is space efficient , Insertion and Searching takes O(1) time ,
Deletion possible in Modified Bloom Filter

18. References
 http://tcpdump.org
 http://wireshark.org
 http://ntop.org
 http://snort.org
 http://openbsd.org
 http://technet.microsoft.com/en-
us/network