|
|
System for Monitoring of Network Protocols
Selecký, Roman ; Dražil, Jan (referee) ; Kořenek, Jan (advisor)
It is necessary to monitor networks namely for diagnostics, troubleshooting, detection of anomalies and suspicious header encapsulations. This thesis aims to design and implement a system for monitoring protocol structure on 10 Gb networks, which will be able to capture packets based on the sequence of encapsulated protocols. To achieve requested throughput some tasks like packet parsing and packet filtering were accelerated in FPGA. Flexibility is achieved by using a tool that maps P4 programs, which define packet parsing process, to VHDL language. Based on the information gained from packet parsing, flow records are created and stored via IPFIX protocol. This information is displayed through a graphical user interface in the form of protocol tree, whose nodes are associated with flow records.
|
|
|
Packet Filtering in Computer Networks
Holuša, Jan ; Kováčik, Michal (referee) ; Kajan, Michal (advisor)
This bachelor's thesis deals with packet classification in computer networks. It describes algorithms which are implemented in experimental Netbench framework. For some of them, there are examples of data structures and searching methods. Part of this thesis is implementation of modular packet classification algorithm. Another part of this thesis describes experiments with this algorithm to find its suitable parameters and experiments with Netbench algorithms for comparison of their space and computational complexity.
|
|
|
Mapping of Match Tables from P4 Language to FPGA Technology
Kekely, Michal ; Matoušek, Jiří (referee) ; Kořenek, Jan (advisor)
This thesis deals with design and implementation of mapping of match action tables from P4 language to FPGA technology. Goal of the thesis was to describe key principles, which need to be understood in order to design such a mapping and function of algorithms needed, apply these principles by implementing them and analyze the speed and memory requirements of such an implementation. Outcome provides configurable hardware unit capable of classifying packets and connection between the unit and match action tables from P4 language. The implementation is based on DCFL algorithm and requires less memory compared to HiCuts and HyperCuts algorithms while being comparably fast at worst-case scenarios.
|
|
|
Packet Filtering Using XDP
Mackovič, Jakub ; Podermański, Tomáš (referee) ; Grégr, Matěj (advisor)
Počítačové systémy, ktoré musia poskytovať svoje služby s vysokou dostupnosťou vyžadujú isté bezpečnostné opatrenia na to, aby ostali dostupné aj pod paketovými sieťovými útokmi. Nevyžiadané pakety musia byť zahodené čo najskôr a čo najrýchlejšie. Táto práca analyzuje eXpress Data Path (XDP) ako techniku skorého zahodenia paketov a extended Berkeley Packet Filter (eBPF) ako mechanizmus rýchlej analýzy obsahu packetov. Poskytuje sa pohľad na dnešnú prax v oblasti firewallov v systémoch s linuxovým jadrom a navrhne sa systém rýchlej filtrácie paketov založený na eBPF a XDP. Do detailov popisujeme naimplementované filtračné riešenie. Nakoniec sa vyzdvihujú výhody XDP oproti ostatným súčasným technikám filtrácie paketov na sérii výkonnostných testov.
|
|
|
Network Traffic Analysis Using NIFIC Device
Melo, Juraj ; Martínek, Tomáš (referee) ; Kořenek, Jan (advisor)
This bachelor's thesis describes examples of using NIFIC device in order to suppress security risks in computer networks. NIFIC is a stateless packet filter with hardware acceleration, suitable for deploying on high-speed networks. This thesis contains examples, presenting usage of this device which can improve network security, in cooperation with other security systems. Some examples are extended with description of another useful features, which provide higher effectivity of network managing and monitoring.
|
|
|
Packet Filtering in Computer Networks
Šrůtka, Petr ; Kováčik, Michal (referee) ; Kajan, Michal (advisor)
This bachelor thesis contains an introduction to packet classification, types of packet classification techniques and different metrics. It describes different algorithms used for packet classification and implementation of Recursive flow classification algorithm is also part of this bachelors thesis. It presents different configuration parameters of RFC algorithm and describes its advantages and disadvantages. This work is concluded with a set of experiments describing characteristics of implemented algorithm together with comparison of other classification approaches.
|
|
|
Packet Filtration in 100 Gb Networks
Kučera, Jan ; Matoušek, Jiří (referee) ; Kořenek, Jan (advisor)
This master's thesis deals with the design and implementation of an algorithm for high-speed network packet filtering. The main goal was to provide hardware architecture, which would support large rule sets and could be used in 100 Gbps networks. The system has been designed with respect to the implementation on an FPGA card and time-space complexity trade-off. Properties of the system have been evaluated using various available rule sets. Due to the highly optimized and deep pipelined architecture it was possible to reach high working frequency (above 220 MHz) together with considerable memory reduction (on average about 72% for compared algorithms). It is also possible to efficiently store up to five thousands of filtering rules on an FPGA with only 8% of on-chip memory utilization. The architecture allows high-speed network packet filtering at wire-speed of 100 Gbps.
|
|
|
Stateful Firewall for FPGA
Žižka, Martin ; Kajan, Michal (referee) ; Puš, Viktor (advisor)
This thesis describes the requirements analysis, design and implementation of stateful packet filtering to an existing stateless firewall. They also deals with testing of the implemented system. The first two chapters describe the properties NetCOPE development platform for FPGA. They also describes the principle of operation firewall, which also serves as a requirements specification for stateful firewall. Then describes the detailed design of individual modules to modify the existing firewall and the proposal for the creation of new modules. It also discusses the implementation of the proposed modules and testing for proper operation. Finally, it discuss the current state of the thesis and describes possible future expansion.
|
|
|
System for Protection against DoS Attacks
Šiška, Pavel ; Wrona, Jan (referee) ; Kučera, Jan (advisor)
This bachelor's thesis deals with the design and implementation of the software part of the system for protection against DoS attacks. Nowadays Denial of Service attacks are quite common and can cause significant financial damage to internet or service providers. The main goal of this thesis was to provide software, which is focused on high-speed data throughput and can provide efficient protection against these attacks in 100 Gbps networks. Key part of the system, which is being developed in cooperation with CESNET, is hardware-accelerated network interface card, which can process incoming network traffic at full wire-speed and does the operations laid down by the software part. The main task of the software is evaluation of the information about network traffic and managing actions of the hardware accelerator. The software part of the proposed system has been successfully implemented and the properties of the system have been verified in an experimental evaluation. During the work on this thesis the first implementation of the system has already been deployed in CESNET network infrastructure.
|
|
|
Probabilistic Packet Classification Acceleration on FPGA
Kurka, Denis ; Matoušek, Jiří (referee) ; Kekely, Lukáš (advisor)
Klasifikace síťových paketů je klíčovým úkolem v síťových systémech, protože umožňuje efektivní směrování a filtrování dat. Pravděpodobnostní filtry jsou klasifikační metoda, která používá různé techniky k aproximaci členství paketu v sadě pravidel. Tato práce zkoumá tři algoritmy: Bloomův filtr, cuckoo filtr a xor filtr. Hlavním cílem je porovnat výkon těchto tří metod při implementaci jako hardwarové komponenty v FPGA systémech. Kritéria hodnocení zahrnují chybovost, maximální frekvenci a využití zdrojů FPGA se zameřením na paměť. Výsledky ukazují, že xor filtr překonává ostatní v oblasti chybovosti, ve všech kategoriích. Bloomův filtr je nejrychlejší volbou pro menší a rychlejší komponenty, kde je vyšší chybovost tolerovatelná. Cuckoo filtr je nejefektivnější z hlediska využití FPGA logiky. Tyto poznatky přispívají k vývoji optimalizovaných klasifikačních systémů a poskytují cenné informace o možnostech implementace pravděpodobnostních filtrů v hardwarových architekturách.
|
guest ::
