Scap: Stream-oriented network traffic capture and analysis for high-speed networks

Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC

Volumn , Issue , 2013, Pages 441-454

  Papadogiannakis, Antonis ^a   Polychronakis, Michalis ^b   Markatos, Evangelos P ^a  

^a INSTITUTE OF COMPUTER SCIENCE   (Greece)

^b Columbia University ^*  (United States)

Author keywords

Overload control; Packet capturing; Packet filtering; Performance; Stream reassembly; Traffic monitoring

Indexed keywords

OVERLOAD CONTROL; PACKET CAPTURING; PACKET FILTERING; PERFORMANCE; STREAM REASSEMBLY; TRAFFIC MONITORING;

COMPLEX NETWORKS; COMPUTER ARCHITECTURE; MICROPROCESSOR CHIPS; NETWORK LAYERS; PACKET NETWORKS; PATTERN MATCHING; SAFETY FACTOR;

NETWORK ARCHITECTURE;

EID: 84890072324     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2504730.2504750     Document Type: Conference Paper

References (53)

1. Application Layer Packet Classifier for Linux (L7-filter). http://l7-filter.sourceforge.net/.
2. Libnids. http://libnids.sourceforge.net/.
3. Performance application programming interface. http://icl.cs.utk.edu/ papi/.
4. Sourcefire vulnerability research team (vrt). http://www.snort.org/vrt/.
5. A. V. Aho and M. J. Corasick. Efficient String Matching: An Aid to Bibliographic Search. Communications of the ACM, 18, 1975.
6. K. G. Anagnostakis, S. Ioannidis, S. Miltchev, J. Ioannidis, M. B. Greenwald, and J. M. Smith. Efficient Packet Monitoring for Network Management. In IFIP/IEEE Network Operations and Management Symposium (NOMS), 2002.
7. P. Barlet-Ros, G. Iannaccone, J. Sanjuàs-Cuxart, D. Amores-López, and J. Solé-Pareta. Load Shedding in Network Monitoring Applications. In USENIX Annual Technical Conference (ATC), 2007.
8. H. Bos, W. de Bruijn, M. Cristea, T. Nguyen, and G. Portokalidis. FFPF: Fairly Fast Packet Filters. In USENIX Symposium on Operating System Design and Implementation (OSDI), 2004.
9. M. Canini, D. Fay, D. J. Miller, A. W. Moore, and R. Bolla. Per Flow Packet Sampling for High-Speed Network Monitoring. In International Conference on Communication Systems and Networks (COMSNETS), 2009.
10. Chelsio Communications. T4 unified wire adapters. http://www.chelsio.com/ adapters/t4-unified-wire-adapters.
11. L. Deri. Improving Passive Packet Capture: Beyond Device Polling. In International System Administration and Network Engineering Conference (SANE), 2004.
12. L. Deri. High-Speed Dynamic Packet Filtering. Journal of Network and Systems Management, 15(3), 2007.
13. L. Deri, J. Gasparakis, P. Waskiewicz, and F. Fusco. Wire-Speed Hardware-Assisted Traffic Filtering with Mainstream Network Adapters. Advances in Network-Embedded Management and Applications, 2011.
14. S. Dharmapurikar and V. Paxson. Robust TCP Stream Reassembly in the Presence of Adversaries. In USENIX Security Symposium, 2005.
15. M. Dobrescu, N. Egi, K. Argyraki, B.-G. Chun, K. Fall, G. Iannaccone, A. Knies, M. Manesh, and S. Ratnasamy RouteBricks: Exploiting Parallelism to Scale Software Routers. In ACM SIGOPS Symposium on Operating Systems Principles (SOSP), 2009.
16. H. Dreger, A. Feldmann, V. Paxson, and R. Sommer. Operational Experiences with High-Volume Network Intrusion Detection. In ACM Conference on Computer and Communications Security (CCS), 2004.
17. F. Fusco and L. Deri. High Speed Network Traffic Analysis with Commodity Multi-core Systems. In ACM SIGCOMM Conference on Internet Measurement (IMC), 2010.
18. G. Gu, P. Porras, V. Yegneswaran, M. Fong, and W. Lee. BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation. In USENIX Security Symposium, 2007.
19. M. Handley, V. Paxson, and C. Kreibich. Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics. In USENIX Security Symposium, 2001.
20. C. M. Inacio and B. Trammell. YAF: Yet Another Flowmeter. In USENIX Large Installation System Administration Conference (LISA), 2010.
21. Intel. 82599 10 GbE Controller Datasheet. http://download.intel.com/ design/network/datashts/82599-datasheet.pdf.
22. Intel Server Adapters. Receive Side Scaling on Intel Network Adapters. http://www.intel.com/support/network/adapter/pro100/sb/cs-027574.htm.
23. S. Ioannidis, K. G. Anagnostakis, J. Ioannidis, and A. D. Keromytis. xPF: Packet Filtering for Low-Cost Network Monitoring. In IEEE Workshop on High-Performance Switching and Routing (HPSR), 2002.
24. T. Karagiannis, A. Broido, M. Faloutsos, and K. claffy. Transport Layer Identification of P2P Traffic. In ACM SIGCOMM Conference on Internet Measurement (IMC), 2004.
25. W. Lee, J. B. D. Cabrera, A. Thomas, N. Balwalli, S. Saluja, and Y. Zhang. Performance Adaptation in Real-Time Intrusion Detection Systems. In International Symposium on Recent Advances in Intrusion Detection (RAID), 2002.
26. T. Limmer and F. Dressler. Improving the Performance of Intrusion Detection using Dialog-based Payload Aggregation. In IEEE Global Internet Symposium (GI), 2011.
27. G. Maier, R. Sommer, H. Dreger, A. Feldmann, V. Paxson, and F. Schneider. Enriching Network Security Analysis with Time Travel. In ACM SIGCOMM Conference on Data Communication, 2008.
28. S. McCanne and V. Jacobson. The BSD Packet Filter: A New Architecture for User-level Packet Capture. In Winter USENIX Conference, 1993.
29. S. McCanne, C. Leres, and V. Jacobson. Libpcap. http://www.tcpdump.org/. LawrenceBerkeleyLaboratory.
30. Myricom. 10G-PCIE-8B-S Single-Port 10-Gigabit Ethernet Network Adapters. https://www.myricom.com/images/stories/10G-PCIE-8B-S.pdf.
31. Myricom. Myricom Sniffer10G. http://www.myricom.com/scs/SNF/doc/, 2010.
32. J. Novak and S. Sturges. Target-Based TCP Stream Reassembly. http://assets.sourcefire.com/snort/developmentpapers/stream5-model-Aug032007. pdf, 2007.
33. A. Papadogiannakis, M. Polychronakis, and E. P. Markatos. Improving the Accuracy of Network Intrusion Detection Systems Under Load Using Selective Packet Discarding. In ACM European Workshop on System Security (EUROSEC), 2010.
34. A. Papadogiannakis, M. Polychronakis, and E. P. Markatos. Tolerating Overload Attacks Against Packet Capturing Systems. In USENIX Annual Technical Conference (ATC), 2012.
35. A. Papadogiannakis, G. Vasiliadis, D. Antoniades, M. Polychronakis, and E. P. Markatos. Improving the Performance of Passive Network Monitoring Applications with Memory Locality Enhancements. Computer Communications, 35(1), 2012.
36. V. Paxson. Bro: A System for Detecting Network Intruders in Real-Time. Computer Networks, 31(23-24), 1999.
37. A. Pesterev, J. Strauss, N. Zeldovich, and R. T. Morris. Improving Network Connection Locality on Multicore Systems. In ACM European Conference on Computer Systems (EuroSys), 2012.
38. T. H. Ptacek and T. N. Newsham. Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection. Technical report, Secure Networks, Inc., 1998.
39. L. Rizzo. netmap: A Novel Framework for Fast Packet I/O. In USENIX Annual Technical Conference (ATC), 2012.
40. M. Roesch. Snort: Lightweight Intrusion Detection for Networks. In USENIX Large Installation System Administration Conference (LISA), 1999.
41. S. Savage, N. Cardwell, D. Wetherall, and T. Anderson. TCP Congestion Control with a Misbehaving Receiver. ACM SIGCOMM Computer Communication Review, 29(5), 1999.
42. U. Shankar and V. Paxson. Active Mapping: Resisting NIDS Evasion without Altering Traffic. In IEEE Symposium on Security and Privacy, 2003.
43. S. Singh, C. Estan, G. Varghese, and S. Savage. Automated worm fingerprinting. In USENIX Symposium on Operating System Design and Implementation (OSDI), 2004.
44. SMC Networks. SMC10GPCIe-XFP Tiger Card 10G PCIe 10GbE XFP Server Adapter. http://www.smc.com/files/AF/ds-SMC10GPCIe-XFP.pdf.
45. R. Smith, C. Estan, and S. Jha. Backtracking Algorithmic Complexity Attacks Against a NIDS. In Annual Computer Security Applications Conference (ACSAC), 2006.
46. Solarfrare. 10GbE LOM/Controller Family. http://www.solarflare.com/ Content/UserFiles/Documents/Solarflare-SFC9000-10GbE-Controller-Brief.pdf.
47. R. Sommer, V. Paxson, and N. Weaver. An Architecture for Exploiting Multi-Core Processors to Parallelize Network Intrusion Prevention. Concurrency and Computation: Practice and Experience, 21(10), 2009.
48. P. Trimintzios, M. Polychronakis, A. Papadogiannakis, M. Foukarakis, E. P. Markatos, and A. Øslebø. DiMAPI: An Application Programming Interface for Distributed Network Monitoring. In IFIP/IEEE Network Operations and Management Symposium (NOMS), 2006.
49. J. Van Der Merwe, R. Caceres, Y. Chu, and C. Sreenan. mmdump: A Tool for Monitoring Internet Multimedia Traffic. ACM SIGCOMM CCR, 30(5), 2000.
50. G. Varghese, J. A. Fingerhut, and F. Bonomi. Detecting Evasion Attacks at High Speeds without Reassembly. In ACM SIGCOMM Conference on Data Communication, 2006.
51. M. Vutukuru, H. Balakrishnan, and V. Paxson. Efficient and Robust TCP Stream Normalization. In IEEE Symposium on Security and Privacy, 2008.
52. S. Woo and K. Park. Scalable TCP Session Monitoring with Symmetric Receive-side Scaling. Technical report, Technical report, KAIST, 2012.
53. Z. Wu, M. Xie, and H. Wang. Swift: A Fast Dynamic Packet Filter. In USENIX Symposium on Networked Systems Design and Implementation (NSDI), 2008.