|
|
Optimalizace systému Suricata zredukovaním mezivláknových závislostí
Kríž, Adam ; Setinský, Jiří (referee) ; Šišmiš, Lukáš (advisor)
In the age of the internet, connection to the global network is possible from almost any type of device. Just to name a few: a fridge, a front door, a smart watches and more. With the growing number of devices that require an internet connection, the security and protection of the user's privacy comes to the foreground. One of the solutions that can be ensured network protection is Suricata, which is used to detect network threats and events. It can deploy as a monitoring system or it can be an active prevention system. Aim of this work will be optimizing the Suricata system in IDS mode (Intrusion Detection System ). As a result of the work, certain data structures will be changed, which will reduce cross-thread dependencies. The result will be an expected increase in performance in the form of savings processor time and increasing the volume of processed packets at the same time. Achieved results will be described in detail and evaluated at the end of the bachelor's thesis.
|
|
|
Accelerating Suricata with pattern-matching metadata
Tobolík, David ; Kekely, Lukáš (referee) ; Šišmiš, Lukáš (advisor)
Suricata je aplikace pro monitorování sítí, která prohledává pakety pomocí sady pravidel pro rozpoznání vzorů v síťovém provozu a v případě, že detekuje podezřelou aktivitu, vyvolá upozornění. Pro porovnávání vzorů Suricata využívá pattern-matching, což je proces náročný na výpočetní zdroje a tvoří většinu času běhu aplikace. Tato práce se zaměřuje na návrh nové komponenty, která si klade za cíl snížit množství porovnávaných vzorů v systému Suricata pomocí přibližného vyhledávání vzorů v aplikaci zvané DPDK Prefilter, která slouží k simulaci specializovaného hardware pomocí softwarové implementace. Nová komponenta přidává vyhledávací metadata k paketům, která jsou v Suricatě použita k potenciálnímu přeskočení pattern-matchingu v případě, že byl paket zkontrolován v DPDK Prefilteru a nebyly nalezeny žádné vzory. Implementace využívá DPDK pro meziprocesovou komunikaci a sdílení dat, pro pattern-matching byl použit Hyperscan. V rámci práce byly navrženy a implementovány různé typy vyhledávacích metadat a některé z nich dokázaly vylepšit výkon Suricaty díky snížení množství pattern-matchingu.
|
|
|
DPDK Accelerated Firewall
Holubář, Jiří ; Fukač, Tomáš (referee) ; Vrána, Roman (advisor)
Nowadays, when almost everyone uses the Internet, network traffic security must also be ensured. This is what firewall helps with. Some routes require higher bandwidth than others. This thesis explores possibilities of using the DPDK library when implementing the firewall in order to achieve the highest possible bandwidth.
|
|
|
Packet Processing Using DPDK Library
Procházka, Aleš ; Lichtner, Ondrej (referee) ; Grégr, Matěj (advisor)
This master thesis focuses on filtering and forwarding packets in high speed networks. Firstly the DPDK framework is introduced, which is used for fast packet processing. This project also introduces a design of application for high-speed packet filtering and design of tools for making it easier to work with that application. Subsequently, the implementation of this design is introduced and testing with comparison of results with a standard firewall
|
|
|
Acceleration of Open vSwitch
Vodák, David ; Orsák, Michal (referee) ; Martínek, Tomáš (advisor)
Virtual switch is a program, which is used for connecting virtual machines to network and that is why it is a crucial part of server virtualization. However virtual switch is consuming too much performance of the server which it is running on. A measurement of Open vSwitch (OvS) indicates that for data speed of 10 Gb/s, approximately 4 cores of the processor are fully occupied. As the consumption of performance is directly proportional to transmission speed, it may eventually get to the point where the consumption of performance cannot be handled. This bachelor thesis is about acceleration of the Open vSwitch with the help of the DPDK Poll Mode Driver extended by support of the SR-IOV virtualization technology as well as the interface for offloading classification rules to hardware called RTE flow. In the scope of this thesis the SR-IOV is implemented and then tested on OvS. Furthermore, the RTE flow support was designed and partially implemented.
|
|
|
Emulation of DPDK Running on an NXP Processor in the QEMU System
Postolka, Matěj ; Dražil, Jan (referee) ; Kořenek, Jan (advisor)
This project deals with the emulation of the networking features of the NXP QorIQ LS2088A processor for the purpose of testing Data Plane Development Kit (DPDK) applications. These networking features are emulated as a virtual PCI device in the QEMU machine emulator. This PCI device is compatible with the DPDK and supports the features offered by the original NXP QorIQ LS2088A hardware, thus providing a virtual environment for testing DPDK applications designed for the original NXP QorIQ LS2088A hardware.
|
|
|
System for the Protection against DoS Attacks Using IDS
Mjasojedov, Igor ; Fukač, Tomáš (referee) ; Kučera, Jan (advisor)
This bachelor's thesis deals with the use of the Intrusion Detection System in the protection of computer networks against Denial of Service attacks. Suricata is the IDS system chosen for this purpose. The main goal of the thesis is to integrate the Suricata system with the DDoS Protector device. DDoS Protector - DCPro is a security network device, which uses, from a software perspective, DPDK technology for high-speed network traffic processing. Due to this fact, this technology was also integrated into the Suricata system. After this integration, the communication between DDoS Protector and Suricata system was allowed more easily. As a result, two DPDK compatible regimes were created in the Suricata system. The individual regime allows Suricata to process network data directly from the network interface card. The second, integrated regime allows DCPro to send network data to the Suricata system for highly precise analysis, which significantly extends DDoS Protector's attack detection abilities.
|
|
|
Acceleration of Open vSwitch in DPDK
Vodák, David ; Kučera, Jan (referee) ; Martínek, Tomáš (advisor)
Virtual switch is a software that connects virtual machines to the internet, which makes it a crucial part of virtualization on servers. Nevertheless, it can be rather ineffective when it comes to high speed traffic, since it switches all frames in the software. This thesis is about hardware acceleration of the virtual switch called Open vSwitch. The acceleration prototype, which is the goal of this thesis, is based on the RTE flow interface, the SR-IOV standard, and Intel PAC N3000 card. In the scope of this master's thesis, all necessary technologies were described and the acceleration prototype was designed, implemented, and tested. Results of executed measurements indicate increased throughput when rules of the acceleration prototype were offloaded to hardware.
|
|
|
Evaluation of rte_flow Network Interface Cards Support
Šuráň, Jakub ; Fukač, Tomáš (referee) ; Šišmiš, Lukáš (advisor)
Podpora klasifikačního rozhraní rte_flow se značně liší napříč různými síťovými kartami. Tato bakalářská práce se zabývá procesem testování této podpory. Hlavním cílem je vyvinout nástroje, které umožní provádět testování systematicky a automatizovaně. K tomuto účelu jsou využity dva přístupy. Ten první je založen na postupném nahrávání rte_flow pravidel do síťové karty a následném sbírání podporovaných vlastností z úspěšných pokusů. Ty jsou na konci využity k vytvoření závěrečného shrnutí. Druhý přístup naopak ověřuje, že jednotlivá pravidla opravdu mají očekávané efekty na pakety zpracovávané kartou. Každý z těchto přístupů byl následně transformován do podoby spustitelného nástroje. Oba byly aplikovány a otestovány na několika síťových kartách od společností Intel a NVIDIA. Zároveň byly výstupy obou z nich použity na vzájemné porovnání podpory rte_flow rozhraní na těchto síťových kartách.
|
|
|
OVS Acceleration Using FPGA Acceleration Card
Vido, Matej ; Martínek, Tomáš (referee) ; Kořenek, Jan (advisor)
The performance of the virtual switch Open vSwitch (OVS) is insufficient to satisfy the current requirements for link bandwidth of the server connections. There is an effort to accelerate the OVS both in the software and in the hardware by offloading the datapath to the smart network interface cards. In this work the COMBO card for 100G Ethernet developed by CESNET is used to accelerate the OVS. The suggested solution utilizes the firmware for FPGA generated from the definition in the P4 language to classify the packets in the card and DPDK for the data transfers and offloading the classification rules into the card. Forwarding of one flow with the shortest frames from physical to physical interface using one CPU core reaches forwarding rate of 11.2 Mp/s (10 times more than the standard OVS) with classification in the card and 5.9 Mp/s without classification in the card.
|
guest ::
