|
|
DPDK Accelerated Firewall
Holubář, Jiří ; Fukač, Tomáš (referee) ; Vrána, Roman (advisor)
Nowadays, when almost everyone uses the Internet, network traffic security must also be ensured. This is what firewall helps with. Some routes require higher bandwidth than others. This thesis explores possibilities of using the DPDK library when implementing the firewall in order to achieve the highest possible bandwidth.
|
|
|
Implementation of a Boot Controller for Intel FPGAs
Hak, Tomáš ; Fukač, Tomáš (referee) ; Matoušek, Jiří (advisor)
This thesis touches the topic of using FPGA technology in the field of computer networks, specifically for hardware acceleration of network traffic processing on a network card developed by the CESNET association. FPGA technology is popular mainly due to the possibility to easily reconfigure the chip and fix any errors or update the firmware. The thesis first discusses the design and implementation of a new unit for Intel FPGA, which will be able to communicate with the external configuration flash memory of the chip featured on the card mentioned above. It then goes on to address the design and implementation of a software tool that will allow, via the newly implemented firmware unit, to load new configuration data into the flash memory and force reconfiguration of the FPGA chip using this newly loaded data. Towards the end of the thesis, the functionality of the newly implemented system is tested in practice.
|
|
|
Protection Against DoS Attacks Using P4 Language
Vojanec, Kamil ; Fukač, Tomáš (referee) ; Kučera, Jan (advisor)
This thesis focuses on reimplementation of existing DoS (Denial of Service) attack mitigation device with high-level P4 programming language. The main reason for using P4 is to enhance adaptability and functionality to different types of DoS attacks. The created device is designed in a modular way and enables easy alterations by using interchangeable components. The target platform for this thesis is an FPGA acceleration card. The work results in designing several DoS mitigation components and implementing applications composed of these components. Pats of this work have been presented at IEEE ANCS (Symposium on Architectures for Networking and Communication Systems) in September 2019 at University of Cambridge.
|
|
|
System for the Protection against DoS Attacks Using IDS
Mjasojedov, Igor ; Fukač, Tomáš (referee) ; Kučera, Jan (advisor)
This bachelor's thesis deals with the use of the Intrusion Detection System in the protection of computer networks against Denial of Service attacks. Suricata is the IDS system chosen for this purpose. The main goal of the thesis is to integrate the Suricata system with the DDoS Protector device. DDoS Protector - DCPro is a security network device, which uses, from a software perspective, DPDK technology for high-speed network traffic processing. Due to this fact, this technology was also integrated into the Suricata system. After this integration, the communication between DDoS Protector and Suricata system was allowed more easily. As a result, two DPDK compatible regimes were created in the Suricata system. The individual regime allows Suricata to process network data directly from the network interface card. The second, integrated regime allows DCPro to send network data to the Suricata system for highly precise analysis, which significantly extends DDoS Protector's attack detection abilities.
|
|
|
Evaluation of rte_flow Network Interface Cards Support
Šuráň, Jakub ; Fukač, Tomáš (referee) ; Šišmiš, Lukáš (advisor)
Podpora klasifikačního rozhraní rte_flow se značně liší napříč různými síťovými kartami. Tato bakalářská práce se zabývá procesem testování této podpory. Hlavním cílem je vyvinout nástroje, které umožní provádět testování systematicky a automatizovaně. K tomuto účelu jsou využity dva přístupy. Ten první je založen na postupném nahrávání rte_flow pravidel do síťové karty a následném sbírání podporovaných vlastností z úspěšných pokusů. Ty jsou na konci využity k vytvoření závěrečného shrnutí. Druhý přístup naopak ověřuje, že jednotlivá pravidla opravdu mají očekávané efekty na pakety zpracovávané kartou. Každý z těchto přístupů byl následně transformován do podoby spustitelného nástroje. Oba byly aplikovány a otestovány na několika síťových kartách od společností Intel a NVIDIA. Zároveň byly výstupy obou z nich použity na vzájemné porovnání podpory rte_flow rozhraní na těchto síťových kartách.
|
|
|
Probe for the Application Protocols Monitoring
Fukač, Tomáš ; Košař, Vlastimil (referee) ; Viktorin, Jan (advisor)
This work describes an extension of the Microprobe functionality for detection and filtering of application protocols. The Microprobe is an embedded system designed for monitoring network links at speed 1 Gb/s without loosing any packets. The detection of application protocols requires using of computationally expensive operations, especially string lookup (usually based on regular expressions). Based on the study of several protocols (SMTP, POP3, FTP, SIP) a draft of a new architecture has been created. The new architecture splits this functionality between programmable logic FPGA and processor. The FPGA performs preprocessing of network traffic consisting of a lookup for user identifiers and protocol-specific patterns. The processor verifies that it is the requested communication. The processor does not need to process the entire network traffic but only the part pre-filtered in the FPGA. The software part is extended by a module for the analysis of SMTP which allows processing of more than 5,000 network flows per second. Support for other protocols can be added by an extension of the software part.
|
|
|
Flexible Load Balancer Using P4 Language
Šesták, Jindřich ; Fukač, Tomáš (referee) ; Martínek, Tomáš (advisor)
Currently servers of internet services are usually grouped together into clusters to provide sufficient performance to serve clients' queries. Each cluster needs Load Balancer, so it can choose one server which will process query from one client. For describing such device that processes packets is convenient to use P4 language. Within this work, the principles of load balancing, design, implementation and testing of a simple Load Balancer described in P4 language were demonstrated. The program is tested using Behavioral model of P4 language on a common processor and on the NFB-200G2QL card thanks to the Netcope environment from the CESNET association
|
|
|
Optimization of the Suricata IDS/IPS
Šišmiš, Lukáš ; Fukač, Tomáš (referee) ; Korček, Pavol (advisor)
V dnešnom svete zrýchľujúcej sa sieťovej prevádzky je potrebné držať krok v jej monitorovaní . Dostatočný prehľad o dianí v sieti dokáže zabrániť rozličným útokom na ciele nachádzajúce sa v nej . S tým nám pomáhajú systémy IDS, ktoré upozorňujú na udalosti nájdené v analyzovanej prevádzke . Pre túto prácu bol vybraný systém Suricata . Cieľom práce je vyladiť nastavenia systému Suricata s rozhraním AF_PACKET pre optimálnu výkonnosť a následne navrhnúť a implementovať optimalizáciu Suricaty . Výsledky z meraní AF_PACKET majú slúžiť ako základ pre porovnanie s navrhnutým vylepšením . Navrhovaná optimalizácia implementuje nové rozhranie založené na projekte Data Plane Development Kit ( DPDK ). DPDK je schopné akcelerovať príjem paketov a preto sa predpokladá , že zvýši výkon Suricaty . Zhodnotenie výsledkov a porovnanie rozhraní AF_PACKET a DPDK je možné nájsť na konci diplomovej práce .
|
|
|
Traffic Shaping in High Speed Networks in DPDK
Doležal, Pavel ; Fukač, Tomáš (referee) ; Vrána, Roman (advisor)
This bachelor thesis is focused on traffic shaping in high speed networks. It presents framework DPDK, which can be used for fast packet processing. General traffic shaping mechanisms are described as well as traffic shaping in Linux using program tc. It also introduces a design and implementation of traffic shaper using DPDK framework for networks with 10 Gbps bandwidth. The traffic shaper uses a complex mechanism of hierarchical token bucket. The system was tested using high speed traffic generator Spirent.
|
|
|
Fast Regular Expression Matching Using FPGA
Kubiš, Juraj ; Fukač, Tomáš (referee) ; Matoušek, Denis (advisor)
Bachelor thesis deals with the possibility of hardware acceleration of regular expression matches. The content of the thesis is to analyze existing hardware architectures and evaluate their positive and negative properties. Based on this knowledge, the architecture is designed. It is based on deterministic finite automata with implicit transitions (D2FA), is implemented in VHDL and is synthesized. The synthesis results are analyzed to determine the overall throughput of the architecture. It is designed software to convert regular expressions into a D2FA and to optimize this automaton in order to minimize memory requirements. The implementation is verified and the benefits of individual optimization techniques to reduce memory requirements are evaluated.
|
guest ::
