1 / 26

Now and Then, How and When? June 16 th , 2009 Stephen Donnelly Technologist | Endace Technology

Now and Then, How and When? June 16 th , 2009 Stephen Donnelly Technologist | Endace Technology SHARK FEST '09 Stanford University June 15-18, 2009. Endace. Potted history 1996 The University of Waikato 2001 Endace created 2005 Publically Listed Specialists in packet capture

tocho
Download Presentation

Now and Then, How and When? June 16 th , 2009 Stephen Donnelly Technologist | Endace Technology

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Now and Then, How and When? June 16th, 2009 Stephen Donnelly Technologist | Endace Technology SHARKFEST'09 Stanford University June 15-18, 2009

  2. Endace Potted history 1996 The University of Waikato 2001 Endace created 2005 Publically Listed Specialists in packet capture High data/packet rates Accurate time stamping Wide variety of network interfaces

  3. Network Monitoring Interfaces DAG cards cover many network technologies 8000 bps to 39813120000 bps TDM - T1/E1/J1 PDH - T3/E3 SONET/SDH - OC-3, 12, 48, 192, 768 InfiniBand – SDR, DDR

  4. Platforms and Appliances Open Platforms Full access Managed Appliances Packet Capture Trace Replay Applied Watch IDS Flow Export Lawful Intercept CACE Pilot

  5. Lossless Packet Capture Capture all packets on link Categorize Filter Present to user Debugging Security Forensics Lawful Intercept

  6. Network Interface Cards Designed to provide inexpensive network connectivity for diverse applications Web, Email, File transfer Generally applications are the bottleneck E.g. a web server generating content Protocols are fault tolerant so NIC need not be LAN traffic is bursty

  7. NIC Device Model Packet Buffers Application Libpcap Tx Descriptor Ring Rx Descriptor Ring Network Stack Packet Filter NIC Driver

  8. Performance Testing Simple Libpcap app counting packets Packets Captured vs. Applied CPU Load Single processor core AMD Opteron 248 (2.2GHz) 2GB DDR 400 DRAM Linux 2.6.12

  9. DAG cards Optimized for packet capture and replay Efficient transfer to and from user applications Capture 100% of received packets Full or partial packet capture Account for any packet loss that does occur Record accurate timestamps Synchronized clocks for timestamp comparisons ERF Format with rich per-packet metadata

  10. DAG 8.1SX

  11. DAG Internals Power Supply Circuits 1 to n Network Physical Layer Interface/s Network Interface / Framer JTAG / Test Connector/s Clock Oscillator FPGA CPLD LEDs ROM Sync Connector Bus Connector Features only on subset of cards Processor RAM Coprocessor FIFO

  12. DAG Stream Buffer Large Static Ring Buffers 4MB to 2GB each Window-based Handshaking Minimize per-packet overhead Memory-mapped to User space Zero copy

  13. DAG Device Model Tx Stream Rx Stream Rx Stream Application Libpcap Libdag Network Stack Packet Filter DAG Driver

  14. Extensible Record Format

  15. Accurate time stamps Debugging/Benchmarking/Optimization QoS/SLA Service response time Storage networks Network equipment HPC Financial services Time=Money, Latency=Risk

  16. Resolution

  17. Reference Clocks GPS Worldwide Clear view of sky CDMA Works indoors Limited coverage Unknown distance to tower Radio (Shortwave) Limited by RF Propagation

  18. Reference Clock Sources

  19. Clock Transports

More Related