Open Innovationvia Java-enabled Network Devices: Collaboration with Business Applications Server Collaboration Active Network Management Diagnostic Mobile Agents Active Intrusion Detection ORE - Oplet Run-time Environment Java-enabled Device Architecture Separation of Control and Forwarding Planes Dynamic Configuration of Forwarding Rules Real-time forwarding Stats and Monitors

1. Open Innovation
via Java-enabled Network Devices
Tal Lavian tlavian@IEEE.org

2. Collaboration with Business Applications
• New paradigm of distributed applications
• Network devices collaborating with business applications
• Application aware routing
JVM
Oracle DB
E-Commerce
Business apps
SAP , ERP,
Optivity
RMI, XML, CORBA
Apps
Switch
Router
Net-Device
Apps
JVM
Apps Server
Oplet Oplet

3. Server Collaboration
• Supports distributed
computing applications in
which network devices
participate
– router to router
– server to router
• Supports Intelligent Agents
• Supports Mobile Agents
Java-based
Application
Java-based
Application
Java-based
Application

4. Active Network Management
• Download Oplet Service to
the device.
• Monitor MIB variables
• Might be complex conditions
• Trend analysis
• DiffServ, RMON-II, etc… MIBs
• Report “events” to NMS
– drop rate, packets/second
• Allow Service to take action
• Download application
• Adjust parameters based on
direction from NMS
Extensive access
to internal resources
Monitor
Appropriate
Application
Download
Download
Complex Condition
Exceeded
No more
polling
NMS
router

5. Diagnostic Mobile Agents
• Automatic trace-route from edge router where
problem exists.
– Each node reached generates a report to NMS
– Trace-route code “moves” to next node in path
– Mobile agents identify router health
– Create logs for NMS

6. Active Intrusion Detection
• Intruder is identified by Intrusion Detection software
• Intruder signature is identified
• Mobile agent is dispatched in direction of intruder
(based on physical port of entry)
• Mobile agent “chases” intruder and terminates him
(shuts down link, reboot host, notify NMS)

7. ORE - Oplet Run-time Environment
Service A
Service B
ORE
JVM
Oplet 1
Oplet 2
Service C
Why ORE?

8. Java-enabled Device Architecture
JNI
ORE Service
Device HW
Oplet
JVM
Operating System
C/C++
API
Java
API
Device
Code Oplet Runtime Env
Device
Drivers
JFWD API
Download

9. Separation of Control and Forwarding Planes
CCeennttrraalliizzeedd,,
CCPPUU--bbaasseedd RRoouutteerr
FFoorrwwaarrddiinngg--PPrroocceessssoorrss
bbaasseedd RRoouutteerr
Routing
SW
Control
Plane
CCoonnttrrooll ++ FFoorrwwaarrddiinngg
FFuunnccttiioonnss ccoommbbiinneedd Control separated
FFrroomm ffoorrwwaarrddiinngg
CPU
CPU
Forwarding
Processor
Forwarding
Processor
Forwarding
Processor
Slow Wire Speed

10. Dynamic Configuration of Forwarding Rules
CPU
Forwarding
Processor
Forwarding
Processor
Forwarding
Processor
Forwarding
Processor
Forwarding
Rules
SW
HW
Forwarding
Rules
Forwarding
Rules
Forwarding
Rules
AN Apps

11. Real-time forwarding Stats and Monitors
CPU
SW
HW
AN Apps
Forwarding
Rules
Forwarding
Processor
Statistics
&Monitors
Forwarding
Rules
Forwarding
Processor
Statistics
&Monitors
Forwarding
Rules
Forwarding
Processor
Statistics
&Monitors

12. Packet Capture
CPU
Forwarding
Processor
Forwarding
Processor
Forwarding
Processor
Forwarding
Processor
Oplet
JFWD to
Divert or Copy
Wire Speed
Packet

13. Dynamic - On the Fly Configuration
Forwarding
Processor
Forwarding
Processor
Packet
Policy
Filters
Dynamic Apps
Packet
Packet
Filter

14. Dynamic DiffServ Classification
Forwarding
Processor
Control
Plane
Forwarding
Processor
Policy
Filters
ORE Service
Packet
Packet
Filter
Packet
• Sample packets, set filters to modify DS-byte for Per-Hop-
Behavior modification