This paper proposes and evaluates performance of an on-demand packet capture process in multi-core architectures. The multi-core on-demand process presented in this paper can handle higher packet throughput and is sufficiently flexible to support even complex per-packet processing logic.

1. .
Experiments with Practical
On-Demand Multi-Core Packet Capture
•how costly is multicore capture compared to one-core? 01
•can CPU cores be spawned on-demand? (precision capture)
•can CPU cores run heterogeneous tasks? (snowball capture)
•NOTE: many methods benefit from multicore capture 02 03 04
 OBJECTIVE: Rapid On-Demand Capture1
1.low/lazy background
capture
2.online analysis
3.precision on-demand
targets
switch/mirror meter
setup
capture
analysis
traffic flow
control,
visualizationscollector
 IMPLEMENTATION: Managed PF_RINGs2
•NOTE: packets are captured and processed in batches 05
Timeline
PF_
RING
PF_
RING
PF_
RING
Manager
capture process
capture process
capture
Core1
Core 2
Core X
PF_RING
meter
User
space
Kernel
Capture
thread
Capture
thread
Capture
thread
NIC Driver
…
…
1G Hub
3 traffic
generator
machines
Linux boxLinux boxLinux box
 RESULTS3
0 200 400 600
Packet throughput (kpps)
24
25
26
27
28
29
30
31
CPUutilization(%,sum)
2
3
1
3
2
2
7
6
1
4
2
6
6
7
4
3
4
5
1
6
7
2
3
5
5
6
4
1
1
2
3
3
73
5
7
5
7
3
3
7 5
2
3
3
1 3
1
3
3
6
44
3
2 4
3
6
4
5
0 500 1000 1500
Packet size (bytes)
24
25
26
27
28
29
30
31
CPUutilization(%,sum)
6
1
6
7
2
1
7
6
4
7
5
5 7
1
5
1
7
7
3
5
1
2
2
6
3
2
1
7
5
6
3
4
5 7
137 2
4
6
3
7
7
2
2
6
2
3
1 6
7
3
7
3
6
1
7
2
1
4
Text bullet = no. of cores (also rings and capture threads)Each plot is a representative sample of all data
0 500 1000 1500
Packet size (bytes)
0
100
200
300
400
500
600
700
kpps(percore)
7 2
1
35
3
7
12 7
1
4
1
3
3
2
3
2
1
3
6 7
1
2
3
7 2
3
1
2
6
6
7 17
5
2
5
6
5
7 747 7
3
5 6 3
2
67
3
7
7
7
6
2
2
A trend: fewer cores
have higher throughput
for the same packet size
No trend here
•basically, zero overhead from added cores
•precision better when short-term.
Resolution..
.Ready for practical usein network/performance/traffic management
Thread 2
Thread 3
Thread 4
Thread 5
Thread 6
Thread 7
1.6 2.4 3.2 4 4.8 5.6
Thread gap as log(us)
-60
-30
0
30
60
90
Threadlag(ms)
Schedule far into the future
Precisionerror
01 Luca Deri ”Modern Packet Capture and Analysis: Multi-Core, Multi-Gigabit, and Beyond” IM Tutorial (2009)
02 myself+1 ”Lightweight Traffic Monitoring and Analysis Using Video Compression Techniques” Springer LNCS vol.5787 (2009)
03 myself+1 ”A Framework for Detection of Traffic Anomalies Based on IP Aggregation” IEICE Trans. on Info. (2009)
04 myself+0 ”A holistic community-based architecture for measuring end-to-end QoS at data centers” Indescience IJCSE (2013)
05 myself+1 ”Control over Precision of Flow Volume Sampling using Random Batch Sampling” IEICE NS (2013)
Marat Zhanikeev (Kyutech) – maratishe@gmail.com – 2013/09/25 – APNOMS/Hiroshima..
1/1