SCAMPI: A Scalable and Programmable Architecture for Monitoring Gigabit Networks

Coppens, Jan; Berghe, Steven Van den; Bos, Herbert; Markatos, Evangelos P.; Turck, Filip De; Oslebo, A.; Ubik, Sven

doi:10.1007/978-3-540-39404-4_36

Cited by 10 publications

(5 citation statements)

References 6 publications

(7 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To take advantage of the positive aspects of both methodologies, many authors propose the use of integrated solutions, where passive and active measurements are combined to achieve more scalable monitoring systems [1,2,9].…”

Section: Measurement Methodologiesmentioning

confidence: 99%

“…In high-speed networks, passive measurements are a particular challenge, specially when all packets have to be accounted for, as the amount of data gathered tend to be substantial and the packet processing time very small. To deal with this, sampling techniques, more powerful hardware and new packet buffering techniques may be required [2].…”

Section: Measurement Methodologiesmentioning

confidence: 99%

See 1 more Smart Citation

Enhancing QoS metrics estimation in multiclass networks

Lima

Sousa

Carvalho

2007

Proceedings of the 2007 ACM Symposium on Applied Computing

View full text Add to dashboard Cite

This paper discusses the problematic of QoS monitoring, suggesting the use of on-line multipurpose active monitoring in multiclass networks as a powerful tool to efficiently assist and enhance the control of multiple service levels. To improve the simultaneous estimation of one-way QoS metrics, we propose a flexible probing source able to adjust probing patterns to the measurement requirements of each service class, exploring pattern coloring to better sense packet loss. The proof-of-concept provided shows that the proposed solution improves the estimation accuracy of multiple QoS metrics significantly, with a reduced probing overhead.

show abstract

Section: Measurement Methodologiesmentioning

confidence: 99%

Section: Measurement Methodologiesmentioning

confidence: 99%

Enhancing QoS metrics estimation in multiclass networks

Lima

Sousa

Carvalho

2007

Proceedings of the 2007 ACM Symposium on Applied Computing

View full text Add to dashboard Cite

show abstract

“…The SCAMPI project also proposes using a smart network adapter to limit the amount of traffic that reaches the host in packet capture scenarios [4,5]. SCAMPI runs on several different architectures, including Intel IXP family of network processors, Endace's DAG cards, and their own network adapter, called "COMBO."…”

Section: Related Workmentioning

confidence: 99%

Shunting

González

Paxson

Weaver

2007

Proceedings of the 14th ACM Conference on Computer and Communications Security

View full text Add to dashboard Cite

Stateful, in-depth, inline traffic analysis for intrusion detection and prevention is growing increasingly more difficult as the data rates of modern networks rise. Yet it remains the case that in many environments, much of the traffic comprising a high-volume stream can, after some initial analysis, be qualified as of "likely uninteresting." We present a combined hardware/software architecture, Shunting, that provides a lightweight mechanism for an intrusion prevention system (IPS) to take advantage of the "heavy-tailed" nature of network traffic to offload work from software to hardware.The primary innovation of Shunting is the introduction of a simple in-line hardware element that caches rules for IP addresses and connection 5-tuples, as well as fixed rules for IP/TCP flags. The caches, using a highest-priority match, yield a per-packet decision: forward the packet; drop it; or divert it through the IPS. By manipulating cache entries, the IPS can specify what traffic it no longer wishes to examine, including directly blocking malicious sources or cutting through portions of a single flow once the it has had an opportunity to "vet" them, all on a fine-grained basis.We have implemented a prototype Shunt hardware design using the NetFPGA 2 platform, capable of Gigabit Ethernet operation. In addition, we have adapted the Bro intrusion detection system to utilize the Shunt framework to offload less-interesting traffic. We evaluate the effectiveness of the resulting system using traces from three sites, finding that the IDS can use this mechanism to offload 55%-90% of the traffic, as well as gaining intrusion prevention functionality.

show abstract

“…Furthermore, a NIDS based on DiMAPI is not restricted to a specific hardware platform. DiMAPI operates on top of a diverse range of monitoring hardware, including sophisticated lower level components [22], and thus, can further optimize overall system performance, considering that certain functions can be pushed to hardware.…”

Section: Distributed Intrusion Detection With Dimapimentioning

confidence: 99%

DiMAPI: An Application Programming Interface for Distributed Network Monitoring

Trimintzios

Polychronakis

Papadogiannakis

et al. 2006

2006 IEEE/IFIP Network Operations and Management Symposium NOMS 2006

View full text Add to dashboard Cite

Abstract-Network monitoring and measurement is commonly regarded as an essential function for understanding, managing and improving the performance and security of network infrastructures. Traditional passive network monitoring approaches are not adequate for fine-grained performance measurements nor for security applications. In addition, many applications would benefit from monitoring data gathered at multiple vantage points within a network infrastructure.This paper presents the design and implementation of DiMAPI, an application programming interface for distributed passive network monitoring. DiMAPI extends the notion of the network flow with the scope attribute, which enables flow creation and manipulation over a set of local and remote monitoring sensors. Experiments with a number of applications on top of DiMAPI show that it has reasonable performance, while the response latency is very close to the actual round trip time between the monitoring application and the monitoring sensors. A broad range of monitoring applications can benefit from DiMAPI to efficiently perform advanced monitoring tasks over a potentially large number of passive monitoring sensors.

show abstract

SCAMPI: A Scalable and Programmable Architecture for Monitoring Gigabit Networks

Cited by 10 publications

References 6 publications

Enhancing QoS metrics estimation in multiclass networks

Enhancing QoS metrics estimation in multiclass networks

Shunting

DiMAPI: An Application Programming Interface for Distributed Network Monitoring

Contact Info

Product

Resources

About