Performance Analysis of Packet Capture Methods in a 10 Gbps Virtualized Environment

Schultz, Michael J.; Crowley, Patrick

doi:10.1109/icccn.2012.6289293

Cited by 5 publications

(3 citation statements)

References 11 publications

(8 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the VM world, apart from the trivial case of directly mapped peripherals, already discussed [8], the problem has not seen many contributions in the literature so far. Among the most relevant: Measurements presented in [23] show that packet capture performance in VMs is significantly slower than on native hardware, but the study does not include the recent techniques mentioned above, nor proposes solutions. Interrupt coalescing and Virtual Receive Side Scaling have been studied in [10] within Xen; the system used in that paper is limited to about 100 Kpps per core, and the solutions proposed impose a heavy latency/throughput tradeoff and burn massive amounts of resources to scale performance.…”

Section: High Speed Networkingmentioning

confidence: 97%

Speeding up packet I/O in virtual machines

Rizzo

Lettieri

Maffione

2013

Architectures for Networking and Communications Systems

View full text Add to dashboard Cite

Most of the work on VM network performance has focused so far on bulk TCP traffic, which covers classical applications of virtualization. Completely new "paravirtualized devices" (Xenfront, VIRTIO, vmxnet) have been designed and implemented to improve network throughput.We expect virtualization to become widely used also for different workloads: packet switching devices and middleboxes, Software Defined Networks, etc.. These applications involve very high packet rates that are problematic not only for the hypervisor (which emulates network interfaces) but also for the host itself (which switches packets between guests and physical NICs).In this paper we provide three main results. First, we demonstrate how rates of millions of packets per second can be achieved even within VMs, with limited but targeted modifications on device drivers, hypervisors and the host's virtual switch. Secondly, we show that emulation of conventional NICs (e.g., Intel e1000) is perfectly capable of achieving such packet rates, without requiring completely different device models. Finally, we provide sets of modifications suitable for different use cases (acting only on the guest, or only on the host, or on both) which can improve the network throughput of a VM by 20 times or more.These results are important because they enable a new set of applications within virtual machines.In particular, we achieve guest-to-guest UDP speeds of over 1 Mpps with short frames (and 6 Gbit/s with 1500-byte frames) using a conventional e1000 device, and socket-based sender/receivers. This matches the speed of the OS on bare metal. Furthermore, we reach over 5 Mpps when guests use the netmap API.Our work requires only small changes to device drivers (about 100 lines, both for FreeBSD and Linux version of e1000), similarly small modifications to the hypervisor (we have a QEMU prototype available) and the use of the VALE switch as a network backend. Relevant changes are being incorporated and/or distributed as external patches for FreeBSD, QEMU and Linux.

show abstract

Section: High Speed Networkingmentioning

confidence: 97%

Speeding up packet I/O in virtual machines

Rizzo

Lettieri

Maffione

2013

Architectures for Networking and Communications Systems

View full text Add to dashboard Cite

show abstract

“…The influence of the virtualization platform on the performance of virtualized network interconnect devices has been elaborated on several papers, adopting different comparison approaches [6]- [11]. However, these comparisons are not accurate due to the exploited methodology of benchmarking Virtual Routers (VRs), as the comparison is performed at only one work point of the virtualized device.…”

Section: Related Workmentioning

confidence: 99%

A novel methodology for efficient throughput evaluation in virtualized routers

Batalla

Kantor

Mavromoustakis

et al. 2015

2015 IEEE International Conference on Communications (ICC)

View full text Add to dashboard Cite

This paper analyzes a novel methodology for calculating the throughput in a device, which hosts multiple virtualized network interconnect devices (i.e. virtual routers). The proposed methodology, which extends the well-known procedure (for non-virtualized IP routers) adopted from RFC 2544, considers the impact of heterogeneity of the offered load at the level of virtual routers. The utility of this methodology is demonstrated, analyzing the throughput of virtualized routers by four different virtualization platforms that use two different techniques, which are the paravirtualization (Xen and Citrix Xen) and the OS-level virtualization (Linux Containers and Jails).The results indicate that the virtualization platforms behave differently to distribution of traffic load among virtual routers. Finally, the need for the proposed methodology is motivated by performing extensive throughput tests on the aforementioned platforms at different work points of the network device (i.e. different offered traffic load distribution between virtual routers).

show abstract

“…As we run the Shield module in a virtual machine, performance issue in virtualized environments is a critical and open problem, which has already been discussed in Ref. [36]. We can further improve performance with vPF ring [37] in virtualized environments.…”

Section: Bottleneck Analysis Of Shieldmentioning

confidence: 99%

Collaborative network security in multi-tenant data center for cloud computing

Chen

Dong

et al. 2014

Tinshhua Sci. Technol.

View full text Add to dashboard Cite

A data center is an infrastructure that supports Internet service. Cloud computing is rapidly changing the face of the Internet service infrastructure, enabling even small organizations to quickly build Web and mobile applications for millions of users by taking advantage of the scale and flexibility of shared physical infrastructures provided by cloud computing. In this scenario, multiple tenants save their data and applications in shared data centers, blurring the network boundaries between each tenant in the cloud. In addition, different tenants have different security requirements, while different security policies are necessary for different tenants. Network virtualization is used to meet a diverse set of tenant-specific requirements with the underlying physical network, enabling multi-tenant datacenters to automatically address a large and diverse set of tenants requirements. In this paper, we propose the system implementation of vCNSMS, a collaborative network security prototype system used in a multi-tenant data center. We demonstrate vCNSMS with a centralized collaborative scheme and deep packet inspection with an open source UTM system. A security level based protection policy is proposed for simplifying the security rule management for vCNSMS. Different security levels have different packet inspection schemes and are enforced with different security plugins. A smart packet verdict scheme is also integrated into vCNSMS for intelligence flow processing to protect from possible network attacks inside a data center network.

show abstract

Performance Analysis of Packet Capture Methods in a 10 Gbps Virtualized Environment

Cited by 5 publications

References 11 publications

Speeding up packet I/O in virtual machines

Speeding up packet I/O in virtual machines

A novel methodology for efficient throughput evaluation in virtualized routers

Collaborative network security in multi-tenant data center for cloud computing

Contact Info

Product

Resources

About