A Highly Configurable Packet Sniffer Based on FPGA for Network Security Applications

Abstract

In recent years web applications and on-line business transactions have grown many folds. Consequently, also cyberattacks have increased and represent a serious threat to the pervasive digital services upon which our society relies. To mitigate cyberattacks, many countermeasures are deployed on computing nodes (e.g., anti-malware software) as well as on network devices to detect and possibly block malicious packets in transit; these monitoring devices broadly go under the name of firewalls. Firewalls are designed according to two main architectural approaches: software running on a standard or embedded computer, or purposedly designed hardware, e.g., ASICs. Software-based solutions have the advantage of high flexibility and can be ported on easily upgradable hardware. However, hardware implementation represents the only viable solution for high data rates. On the market, very fast devices of the latter kind are available, but their cost is typically very high, especially considering that their ultra-optimized design makes updating them very difficult, with the consequence of a rather short lifespan. As a more balanced alternative, we wanted to investigate the use of an FPGA architecture, , which is significantly easier to update than custom-built chips, and features low-latency and high-throughput characteristics concurrently, making it preferrable to other programmable systems based on GPUs or microcontrollers. In this paper a packet sniffer that has been designed on FPGA with a 1 Gbit/s data transfer rate is presented. The system is implemented on the FPGA development board KC705 by Xilinx, can analyze Ethernet frames, checking the frame fields against a set of rules defined by the user and calculates statistics of the received Ethernet frames over time. The designed packet sniffer has been successfully tested both with Ethernet frames ad hoc generated using a packets generator, and with real web traffic by connecting the packet sniffer to the internet.