Improving the performance of passive network monitoring applications with memory locality enhancements

Computer Communications

Volumn 35, Issue 1, 2012, Pages 129-140

  Papadogiannakis, Antonis ^a   Vasiliadis, Giorgos ^a   Antoniades, Demetres ^a   Polychronakis, Michalis ^b   Markatos, Evangelos P ^a  

^a INSTITUTE OF COMPUTER SCIENCE   (Greece)

^b Department of Earth and Environmental Sciences   (United States)

Author keywords

Intrusion detection systems; Locality buffering; Packet capturing; Passive network monitoring

Indexed keywords

COMPLEX ANALYSIS; CPU RESOURCES; CPU TIME; CRITICAL ISSUES; DATA LOCALITY; EXPERIMENTAL EVALUATION; GROWING DEMAND; INTRUSION DETECTION SYSTEMS; LARGE CLASS; LOCALITY BUFFERING; MEMORY LOCALITY; MONITORING APPLICATIONS; NETFLOWS; NETWORK LINKS; NETWORK MONITORING; NETWORK MONITORING SYSTEMS; NETWORK PACKETS; PACKET CAPTURING; PACKET LOSS RATES; PACKET PROCESSING; PASSIVE MONITORING; PASSIVE NETWORK MONITORING; PORT NUMBERS; REORDERED PACKETS; RUNTIME PERFORMANCE; TRAFFIC CHARACTERIZATION; TRAFFIC RATE;

COMPUTER CRIME; INTRUSION DETECTION; MONITORING; PACKET NETWORKS; THROUGHPUT;

PASSIVE NETWORKS;

EID: 81255157603     PISSN: 01403664     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.comcom.2011.08.003     Document Type: Article

References (31)

1. M. Roesch, Snort: Lightweight intrusion detection for networks, in: Proceedings of the USENIX Systems Administration Conference (LISA), 1999.
2. D. Antoniades, M. Polychronakis, S. Antonatos, E.P. Markatos, S. Ubik, A. Oslebo, Appmon: an application for accurate per application traffic characterization, in: Proceedings of the IST Broadband Europe Conference, 2006.
3. Fprobe: Netflow probes, .
4. M. Grossglauser, J. Rexford, Passive traffic measurement for IP operations, in: The Internet as a Large-Scale Complex System, 2005, pp. 91-120.
5. V. Paxson, Bro: A system for detecting network intruders in real-time, in: Proceedings of the 7th USENIX Security Symposium, 1998.
6. M. Handley, V. Paxson, C. Kreibich, Network intrusion detection: evasion, traffic normalization, and end-to-end protocol semantics, in: Proceedings of the 10th USENIX Security Symposium, 2001.
7. S. McCanne, C. Leres, V. Jacobson, libpcap, lawrence Berkeley Laboratory, Berkeley, CA. (software available from ).
8. G. Insolvibile Inside the linux packet filter Linux Journal 94 2002
9. J.C. Mogul, and K.K. Ramakrishnan Eliminating receive livelock in an interrupt-driven kernel ACM Transactions on Computer Systems 15 3 1997 217 252
10. J.H. Salim, R. Olsson, A. Kuznetsov, Beyond softnet, in: ALS '01: Proceedings of the 5th Annual Conference on Linux Showcase & Conference, 2001.
11. S. McCanne, V. Jacobson, The BSD Packet Filter: A new architecture for user-level packet capture, in: Proceedings of the Winter 1993 USENIX Conference, 1993, pp. 259-270.
12. L. Deri, Improving passive packet capture:beyond device polling, in: Proceedings of the 4th International System Administration and Network Engineering Conference (SANE), 2004.
13. L. Deri, ncap: Wire-speed packet capture and transmission, in: Proceedings of the IEEE/IFIP Workshop on End-to-End Monitoring Techniques and Services (E2EMON), 2005.
14. A. Biswas, P. Sinha, On improving performance of network intrusion detection systems by efficient packet capturing, in: Proceedings of the 10th IEEE/IFIP Network Operations and Management Symposium (NOMS), Vancouver, Canada, 2006.
15. L. Braun, A. Didebulidze, N. Kammenhuber, G. Carle, Comparing and improving current packet capturing solutions based on commodity hardware, in: Proceedings of the 10th Annual Conference on Internet Measurement (IMC), 2010, pp. 206-217.
16. F. Schneider, J. Wallerich, A. Feldmann, Packet capture in 10-gigabit ethernet environments using contemporary commodity hardware, in: Proceedings of the 8th International Conference on Passive and Active network Measurement (PAM), 2007, pp. 207-217.
17. H. Bos, W. de Bruijn, M. Cristea, T. Nguyen, G. Portokalidis, FFPF: fairly fast packet filters, in: Proceedings of the 6th Conference on Symposium on Opearting Systems Design & Implementation (OSDI), 2004.
18. R. Watson, C. Peron, Zero-Copy BPF Buffers, FreeBSD Developer Summit.
19. A. Fiveg, Ringmap capturing stack for high performance packet capturing in FreeBSD, FreeBSD Developer Summit.
20. Dag ethernet network monitoring cards, Endace measurement systems, .
21. Sourcefire vulnerability research team (vrt), .
22. A.V. Aho, and M.J. Corasick Efficient string matching: an aid to bibliographic search Communications of the ACM 18 1975 333 340
23. Performance application programming interface, .
24. Tcpreplay, .
25. K. Xinidis, I. Charitakis, S. Antonatos, K.G. Anagnostakis, and E.P. Markatos An active splitter architecture for intrusion detection and prevention IEEE Transactions on Dependable and Secure Computing 03 1 2006 31 44
26. E.P. Markatos, D.N. Pnevmatikatos, M.D. Flouris, and M.G.H. Katevenis Web-conscious storage management for web proxies IEEE/ACM Transactions on Networking 10 6 2002 735 748
27. F. Schneider, J. Wallerich, Performance evaluation of packet capturing systems for high-speed networks, in: Proceedings of the 2005 ACM Conference on Emerging Network Experiment and Technology (CoNEXT), 2005, pp. 284-285.
28. M. Vallentin, R. Sommer, J. Lee, C. Leres, V. Paxson, B. Tierney, The NIDS cluster: Scalable, stateful network intrusion detection on commodity hardware, in: Proceedings of the 10th International Symposium on Recent Advances in Intrusion Detection (RAID), 2007, pp. 107-126.
29. F. Fusco, L. Deri, High speed network traffic analysis with commodity multi-core systems, in: Proceedings of the 10th annual conference on Internet measurement (IMC), 2010, pp. 218-224.
30. Intel Server Adapters, Receive side scaling on Intel Network Adapters, .
31. R. Sommer, V. Paxson, and N. Weaver An architecture for exploiting multi-core processors to parallelize network intrusion prevention Concurrency and Computation: Practice and Experience 21 10 2009 1255 1279