Improving the performance of passive network monitoring applications with memory locality enhancements

Abstract

Passive network monitoring is the basis for a multitude of systems that support the robust, efficient, and secure operation of modern computer networks. Emerging network monitoring applications are more demanding in terms of memory and CPU resources due to the increasingly complex analysis operations that are performed on the inspected traffic. At the same time, as the traffic throughput in modern network links increases, the CPU time that can be devoted for processing each network packet decreases. This leads to a growing demand for more efficient passive network monitoring systems in which runtime performance becomes a critical issue.In this paper we present locality buffering, a novel approach for improving the runtime performance of a large class of CPU and memory intensive passive monitoring applications, such as intrusion detection systems, traffic characterization applications, and NetFlow export probes. Using locality buffering, captured packets are being reordered by clustering packets with the same port number before they are delivered to the monitoring application. This results in improved code and data locality, and consequently, in an overall increase in the packet processing throughput and decrease in the * Corresponding author. Tel: +30 2810 391663. Fax: +30 2810 391601.Email addresses: papadog@ics.forth.gr (Antonis Papadogiannakis), gvasil@ics.forth.gr (Giorgos Vasiliadis), danton@ics.forth.gr (Demetres Antoniades), mikepo@cs.columbia.edu (Michalis Polychronakis), markatos@ics.forth.gr (Evangelos P. Markatos) Preprint submitted to Computer CommunicationsAugust 10, 2011 packet loss rate. We have implemented locality buffering within the widely used libpcap packet capturing library, which allows existing monitoring applications to transparently benefit from the reordered packet stream without modifications. Our experimental evaluation shows that locality buffering improves significantly the performance of popular applications, such as the Snort IDS, which exhibits a 21% increase in the packet processing throughput and is able to handle 67% higher traffic rates without dropping any packets.

Stream-Oriented Network Traffic Capture and Analysis for High-Speed Networks

“…Thus, stream reassembly is performed only once within the kernel, instead of multiple times Performing stream reassembly in the kernel also offers significant advantages in terms of cache locality. Existing user-level TCP stream reassembly implementations receive packets of different flows highly interleaved, which results in poor cache locality [32]. In contrast, Scap provides user-level applications with reassembled streams instead of randomly interleaved packets, allowing for improved memory locality and reduced cache misses.…”

“…The only difference between Scap's packet delivery and packetbased capture systems is that packets from the same stream are processed together. As an added benefit, such flow-based packet reordering has been found to significantly improve cache locality [32]. The stream's processing time and the total number of processed chunks are available through the sd->processing_time and sd->chunks fields.…”

“…Papadogiannakis et al [32] show that memory access locality in passive network monitoring applications can be improved when reordering the packet stream based on source and destination port numbers. Scap also improves memory access locality and cache usage in a similar manner when grouping packets into streams.…”

High-Performance Network Traffic Processing Systems Using Commodity Hardware

“…After extensive code analysis and performance tests, several main problems have been identified [4,8,16,17]:…”

Development of a Flexible Real-Time Monitor for an Enterprise Network

“…Generally, most of the tools attend specific requirements on how and which network information is presented [1,2]. Network monitoring can be broadly classified into active monitoring and passive monitoring [3,4]. Active or "intrusive" monitoring uses equipment that divides the circuit into two segments and allows the flow of traffic to be monitored, and actively transmitted from one side of the monitor point to another.…”