Extensible and Scalable Network Monitoring Using OpenSAFE Jeffrey - - PowerPoint PPT Presentation

▶
extensible and scalable network monitoring using opensafe
SMART_READER_LITE
LIVE PREVIEW

Extensible and Scalable Network Monitoring Using OpenSAFE Jeffrey - - PowerPoint PPT Presentation

Aug 21, 2023 453 likes •825 views

Background OpenSAFE and ALARMS Implementation Conclusion Extensible and Scalable Network Monitoring Using OpenSAFE Jeffrey R. Ballard Ian Rae Aditya Akella Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network

slide-1
SLIDE 1

Background OpenSAFE and ALARMS Implementation Conclusion

Extensible and Scalable Network Monitoring Using OpenSAFE

Jeffrey R. Ballard Ian Rae Aditya Akella

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-2
SLIDE 2

Background OpenSAFE and ALARMS Implementation Conclusion

Outline

1 Background

Network monitoring How monitoring is done today

2 OpenSAFE and ALARMS

OpenSAFE ALARMS Rule Aggregation Distribution

3 Implementation

Mapping to OpenFlow Switch Example

4 Conclusion

Related Work

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-3
SLIDE 3

Background OpenSAFE and ALARMS Implementation Conclusion Network monitoring How monitoring is done today

Motivation

We want to monitor the network. Specifically, we want to allow administrators to easily:

  • collect network usage statistics
  • detect intrusions
  • provide forensic evidence

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-4
SLIDE 4

Background OpenSAFE and ALARMS Implementation Conclusion Network monitoring How monitoring is done today

Challenges

Middleboxes are commonly used, however, they present challenges. . .

1 Speed 2 Cost 3 Flexibility 1 Setup: rewire 2 Change: rewire 3 Add new middlebox: rewire

. . . making them ill suited for network monitoring.

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-5
SLIDE 5

Background OpenSAFE and ALARMS Implementation Conclusion Network monitoring How monitoring is done today

Example: College of Engineering

Building 1 Building 3 Building 2 Building 4 Building 5 Building 6 Building 7 Router 2 Campus Backbone Routers Router 1 x5 x2 x2 x2 x2 x2 Red links = 10 Gbps White links = 1 Gbps Connections to the College: 2 x 10 Gbps links 22 x 1 Gbps links x2

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-6
SLIDE 6

Background OpenSAFE and ALARMS Implementation Conclusion Network monitoring How monitoring is done today

How do people actually do it?

Mirror (or tap) an interesting network interface to another switch port, then listen to that port with something like Snort. Advantage over a middlebox: monitoring has no impact on the production traffic and routes. Disadvantages: the traffic can run you over, and it’s still hard to add new detectors.

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-7
SLIDE 7

Background OpenSAFE and ALARMS Implementation Conclusion Network monitoring How monitoring is done today

What it looks like today

Network B Network A Monitoring Device Network B Firewall

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-8
SLIDE 8

Background OpenSAFE and ALARMS Implementation Conclusion Network monitoring How monitoring is done today

What we want to do

Network B Network A Programmable Network Layer Network B Firewall Monitoring Device 2 Monitoring Device 1 Monitoring Device n ...

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-9
SLIDE 9

Background OpenSAFE and ALARMS Implementation Conclusion OpenSAFE ALARMS Rule Aggregation Distribution

OpenSAFE

OpenSAFE uses a programmable network fabric

  • to. . .
  • Selectively match network flows
  • Arbitrarily direct network flows to other switch

ports at line rate

  • Direct exceptions to a software component
  • Enable the use of commodity network hardware

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-10
SLIDE 10

Background OpenSAFE and ALARMS Implementation Conclusion OpenSAFE ALARMS Rule Aggregation Distribution

Why not implement it in software?

We could use something like Click to dynamically manage detectors. Major problem: software is not fast enough!

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-11
SLIDE 11

Background OpenSAFE and ALARMS Implementation Conclusion OpenSAFE ALARMS Rule Aggregation Distribution

Solution: Hardware!

Easiest: Custom ASICs

1 Expensive 2 Non-standard 3 Potentially hard to configure

But we have something that can do this. . .

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-12
SLIDE 12

Background OpenSAFE and ALARMS Implementation Conclusion OpenSAFE ALARMS Rule Aggregation Distribution

Programmable Network Fabric

While OpenSAFE would be compatible with any programmable network fabric, we implemented OpenSAFE in OpenFlow since it is available today. The key elements are:

1 speed 2 heterogeneity 3 flexibility 4 cost

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-13
SLIDE 13

Background OpenSAFE and ALARMS Implementation Conclusion OpenSAFE ALARMS Rule Aggregation Distribution

Example OpenSAFE Layout

Network B Network A OpenFlow Network B Firewall dSniff Snort Decryption OpenFlow Controller

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-14
SLIDE 14

Background OpenSAFE and ALARMS Implementation Conclusion OpenSAFE ALARMS Rule Aggregation Distribution

ALARMS

ALARMS: A Language for Arbitrary Route Management for Security Basic building blocks are paths of:

  • Inputs: copy of traffic from a mirror switch port
  • Selects: restricts the set of traffic for this rule
  • Filters: pass the traffic through an application
  • Sinks: where to finally direct the traffic

Combining these gives us a rich set of configurations.

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-15
SLIDE 15

Background OpenSAFE and ALARMS Implementation Conclusion OpenSAFE ALARMS Rule Aggregation Distribution

Simple Example

We will use the following example over the next few slides:

Mirror

Port: 80

Counter TCP Dump

Take all TCP port 80 traffic, send it to a counter, and then send it to a machine running tcpdump.

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-16
SLIDE 16

Background OpenSAFE and ALARMS Implementation Conclusion OpenSAFE ALARMS Rule Aggregation Distribution

Paths

Input Sinks Select Filters

A path is: A source switch port with selection criteria . . . which goes into zero or more filters . . . then out to one or more sinks

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-17
SLIDE 17

Background OpenSAFE and ALARMS Implementation Conclusion OpenSAFE ALARMS Rule Aggregation Distribution

OpenSAFE Schematic

OpenFlow Switch Input Sink1 Filter1 Filterm Sinkn ... ...

OpenFlow Controller

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-18
SLIDE 18

Background OpenSAFE and ALARMS Implementation Conclusion OpenSAFE ALARMS Rule Aggregation Distribution

Policy naming

In OpenSAFE all switch ports are named. Logically, ALARMS articulates paths of named switch ports.

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-19
SLIDE 19

Background OpenSAFE and ALARMS Implementation Conclusion OpenSAFE ALARMS Rule Aggregation Distribution

Revisiting our example

Mirror

Port: 80

Counter TCP Dump

. . . becomes . . .

Mirror Counter TCP Dump Port 80

mirror[http] -> counter -> tcpdump;

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-20
SLIDE 20

Background OpenSAFE and ALARMS Implementation Conclusion OpenSAFE ALARMS Rule Aggregation Distribution

Let’s get some more paths

Mirror Counter TCP Dump Port 80

mirror[http] -> counter -> tcpdump;

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-21
SLIDE 21

Background OpenSAFE and ALARMS Implementation Conclusion OpenSAFE ALARMS Rule Aggregation Distribution

Let’s get some more paths

Mirror Counter TCP Dump Port 80

mirror[http] -> counter -> tcpdump;

Mirror Counter TCP Dump Port 443 Decryption

mirror[https] -> decrypt -> counter -> tcpdump;

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-22
SLIDE 22

Background OpenSAFE and ALARMS Implementation Conclusion OpenSAFE ALARMS Rule Aggregation Distribution

Waypoints

As more rules are added, often the rules follow the same paths making rule management difficult. Solution: Waypoint Waypoints are virtual destinations for paths.

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-23
SLIDE 23

Background OpenSAFE and ALARMS Implementation Conclusion OpenSAFE ALARMS Rule Aggregation Distribution

Waypoint example

Mirror Port 80 Mirror Counter TCP Dump Port 443 Decryption Web

mirror[https] -> decrypt -> web; mirror[http] -> web; web -> counter -> tcpdump;

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-24
SLIDE 24

Background OpenSAFE and ALARMS Implementation Conclusion OpenSAFE ALARMS Rule Aggregation Distribution

Multiple Destinations

In ALARMS, multiple destinations are easy:

Mirror TCP Dump 1 Port 80 TCP Dump 2

mirror[http] -> {ALL, tcpdump1, tcpdump2};

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-25
SLIDE 25

Background OpenSAFE and ALARMS Implementation Conclusion OpenSAFE ALARMS Rule Aggregation Distribution

Distribution rules

When parallel filters or sinks are used, distribution rules describe how traffic flows should be spread. Rules include: Any Randomly pick a switch port All Replicate packet to all switch ports Round Robin Cycle through the switch ports Hash Apply a hash function

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-26
SLIDE 26

Background OpenSAFE and ALARMS Implementation Conclusion OpenSAFE ALARMS Rule Aggregation Distribution

Multiple Destinations

Mirror TCP Dump 1 Port 80 Mirror TCP Dump 2 Port 443 Decryption Web

web -> {ALL, tcpdump1, tcpdump2};

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-27
SLIDE 27

Background OpenSAFE and ALARMS Implementation Conclusion Mapping to OpenFlow Switch Example

Mapping the language into OpenFlow

We want to handle lots of traffic, so need high performance. Hardware is fast. Software is slow. Install as many precomputed flow entries as possible. However, when the hardware does not support functions we must go to software. In OpenFlow this includes Any, Round Robin, and Hash distribution rules.

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-28
SLIDE 28

Background OpenSAFE and ALARMS Implementation Conclusion Mapping to OpenFlow Switch Example

How it works under the hood

Starting with the last path diagram we had

  • before. . .

Mirror TCP Dump 1 Port 80 Mirror TCP Dump 2 Port 443 Decryption Web

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-29
SLIDE 29

Background OpenSAFE and ALARMS Implementation Conclusion Mapping to OpenFlow Switch Example

How it works under the hood

OpenFlow Switch Mirror TCP Dump 1 TCP Dump 2 Decryption

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-30
SLIDE 30

Background OpenSAFE and ALARMS Implementation Conclusion Mapping to OpenFlow Switch Example

How it works under the hood

OpenFlow Switch Mirror TCP Dump 1 TCP Dump 2 Decryption Web

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-31
SLIDE 31

Background OpenSAFE and ALARMS Implementation Conclusion Mapping to OpenFlow Switch Example

How it works under the hood

OpenFlow Switch Mirror TCP Dump 1 TCP Dump 2 Decryption

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-32
SLIDE 32

Background OpenSAFE and ALARMS Implementation Conclusion Related Work Future Work Conclusion

Related Work: Ethane

Ethane (the predecessor to OpenFlow) is an enterprise-wide security solution. The focus here is to insert a tool just at the border,

  • ptimized for the border.

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-33
SLIDE 33

Background OpenSAFE and ALARMS Implementation Conclusion Related Work Future Work Conclusion

Related Work: Policy-aware switching

Policy-aware switching, proposed by Joseph et al. is somewhat similar to Ethane. It removes the centralized controller, and has each switch determine the next hop. Also, the policy specification language, like Ethane, is centered around deciding appropriate paths for a flow.

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-34
SLIDE 34

Background OpenSAFE and ALARMS Implementation Conclusion Related Work Future Work Conclusion

What next?

In the future, we’d like to expand our system by exploring:

  • incorporating dynamic feedback from filters

and sinks

  • precomputing more dynamic distribution rules

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-35
SLIDE 35

Background OpenSAFE and ALARMS Implementation Conclusion Related Work Future Work Conclusion

Conclusion

OpenSAFE greatly simplifies high-speed network monitoring. It is also:

  • Cost effective by using commodity hardware
  • Flexible and easy to modify
  • Capable of operating at high line rates

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE

slide-36
SLIDE 36

Background OpenSAFE and ALARMS Implementation Conclusion

Questions?

Questions?

Jeffrey R. Ballard, Ian Rae, Aditya Akella Extensible and Scalable Network Monitoring Using OpenSAFE