Integrated Network Traffic Processing Framework

Abstract

Knowledge of what data are carried by network links is crucial to be able to prevent attacks and to improve quality of services. Therefore it is important to develop network monitoring tools which can operate on speeds of new gigabit networks. This thesis discusses general principles of designing a highly flexible framework which is divided into several levels. These spread across various hardware and software environments. This allows us to keep up with a gigabit speed. We show details on an extension of the FFPF framework to run on top of an IXP based PCI board. In addition, we present an implementation of Ruler, a language for packet pattern matching and data anonymization, implemented for highspeed traffic monitoring using IXP network processor. This work also presents performance evaluation, discussion of bottle-necks, general problems and compares with other related projects.