skip to main content
OSTI.GOV title logo U.S. Department of Energy
Office of Scientific and Technical Information

Title: An Initial Investigation of the Design Challenges Associated with Reliable 100GigE Packet Capture.

Abstract

Network security researchers often rely on EmulyticsTM to provide a way to evaluate the safety and security of real world systems. This work involves running a large number of virtual machines on a distributed platform to observe how software and hardware will respond to different types of attacks. While EmulyticsTM software such as minimega [2] provide a scalable system for conducting experiments, the sheer volume of network traffic produced in an experiment can easily exceed the rate at which data can be recorded for offline analysis. As such, researchers must perform live analytics, narrow their monitoring scope or accept that they must run an experiment multiple times to capture all the information they require. In support of Sandia's commitment to EmulyticsTM, we are developing new storage components for the Carlin cluster that will enable researchers to capture significantly more network traffic from their experiments. This report provides a summary of Haoda Wang's initial investigation of how new AMD Epyc storage nodes can be adapted to perform packet capture at 100Gbps speeds with minimal loss. This work found that the NVMe storage capabilities of the Epyc architecture are suitable for capturing 100Gbps Ethernet traffic. While capturing traffic with existing libraries wasmore » surprisingly challenging, we were able to develop a DPDK-based software tool that recorded network traffic to disk with minimal packet loss.« less

Authors:
; ; ;
Publication Date:
Research Org.:
Sandia National Lab. (SNL-CA), Livermore, CA (United States)
Sponsoring Org.:
USDOE National Nuclear Security Administration (NNSA)
OSTI Identifier:
1560808
Report Number(s):
SAND2019-10319
679003
DOE Contract Number:  
AC04-94AL85000
Resource Type:
Technical Report
Country of Publication:
United States
Language:
English

Citation Formats

Wang, Haoda, Baker, Gavin Matthew, Kenny, Joseph P., and Ulmer, Craig D. An Initial Investigation of the Design Challenges Associated with Reliable 100GigE Packet Capture.. United States: N. p., 2019. Web. doi:10.2172/1560808.
Wang, Haoda, Baker, Gavin Matthew, Kenny, Joseph P., & Ulmer, Craig D. An Initial Investigation of the Design Challenges Associated with Reliable 100GigE Packet Capture.. United States. https://doi.org/10.2172/1560808
Wang, Haoda, Baker, Gavin Matthew, Kenny, Joseph P., and Ulmer, Craig D. Sun . "An Initial Investigation of the Design Challenges Associated with Reliable 100GigE Packet Capture.". United States. https://doi.org/10.2172/1560808. https://www.osti.gov/servlets/purl/1560808.
@article{osti_1560808,
title = {An Initial Investigation of the Design Challenges Associated with Reliable 100GigE Packet Capture.},
author = {Wang, Haoda and Baker, Gavin Matthew and Kenny, Joseph P. and Ulmer, Craig D.},
abstractNote = {Network security researchers often rely on EmulyticsTM to provide a way to evaluate the safety and security of real world systems. This work involves running a large number of virtual machines on a distributed platform to observe how software and hardware will respond to different types of attacks. While EmulyticsTM software such as minimega [2] provide a scalable system for conducting experiments, the sheer volume of network traffic produced in an experiment can easily exceed the rate at which data can be recorded for offline analysis. As such, researchers must perform live analytics, narrow their monitoring scope or accept that they must run an experiment multiple times to capture all the information they require. In support of Sandia's commitment to EmulyticsTM, we are developing new storage components for the Carlin cluster that will enable researchers to capture significantly more network traffic from their experiments. This report provides a summary of Haoda Wang's initial investigation of how new AMD Epyc storage nodes can be adapted to perform packet capture at 100Gbps speeds with minimal loss. This work found that the NVMe storage capabilities of the Epyc architecture are suitable for capturing 100Gbps Ethernet traffic. While capturing traffic with existing libraries was surprisingly challenging, we were able to develop a DPDK-based software tool that recorded network traffic to disk with minimal packet loss.},
doi = {10.2172/1560808},
url = {https://www.osti.gov/biblio/1560808}, journal = {},
number = ,
volume = ,
place = {United States},
year = {2019},
month = {9}
}