Software Defined Networking
Community ID Flow Hashing
Simple flow tuple correlation for Zeek, Suricata, and beyond
Network security practitioners frequently need to correlate logs and alerts produced by the systems installed in their networks. For example, a Suricata alert might require the context of Zeek's connection logs for the alert to become actionable. Normally the best way to make such correlations is by manually identifying the flow tuple involved, in each of the monitor outputs involved, around the timestamps in question -- a tedious and error-prone task.
To simplify this process we're standardizing a straightforward algorithm, dubbed "Community ID" (https://github.com/corelight/community-id-spec), that produces short textual hashes that reliably identify network flows directly at the source. Flow correlation then becomes a straightforward string comparison operation. Popular open-source network monitoring solutions now include support for this emerging standard, including Suricata, Wireshark, and Zeek, and there's a growing library of reusable implementations in various common programming languages.
In this talk we will motivate the Community ID standard, report on its current implementation status, and demonstrate it to the community.
Additional information
| Type | devroom |
|---|
More sessions
| 2/7/21 |
In this talk, we first show how to prototype high-speed network functions with FastClick, an open-source packet processing framework, which comes with hundreds of pre-built building blocks and leverages DPDK or Netmap to build 100-Gbps-capable firewalls, load-balancers, NATs, or IDSes. We then review the history of high-speed software dataplanes. We explain the evolution of graph-based (software) network packet processing from the early 2000s with the emergence of the Click Modular Router, and ...
|
| 2/7/21 |
Overview of fully automated open-source FD.io benchmarking (per patch, daily/weekly trending, per release) with focus on network data plane (VPP, DPDK). Quick walk through HW systems with CI'ed calibration and testing (Xeon, Atom, Cortex, EPYC, 10/25/40/100GE, QAT) and stateless / stateful network test methodologies using TRex. Implemented benchmark and analytics strategies / algorithms for high volume non-stop CI benchmarks: i) optimized throughput rate discovery, ii) self-guiding soak tests, ...
|
| 2/7/21 |
While the Ostinato traffic generator can import, edit and replay packets from PCAP files, most users prefer to craft packets from scratch using the Ostinato GUI which has support for common protocols out of the box. To add more protocols quickly and easily, Ostinato has a Protocol Builder framework using which new protocols can be added. In this talk, Ostinato creator Srivats P shows you how to add a new protocol using this framework.
|
| 2/7/21 |
I present a solution to run Linux’s eXpress Data Path programs written in eBPF on FPGAs, using only a fraction of the available hardware resources while matching the performance of high-end CPUs. The iterative execution model of eBPF is not a good fit for FPGA accelerators.
|
| 2/7/21 |
Setting up multi-cluster and multi-cloud container networking for dev environments has been too harder than it needs to be. NoRouter is a novel instant networking stack to overcome this difficulty, by transferring IP packets over stdio streams (aka "shell connections"). NoRouter works with any container, any VM, and any baremetal machine, on anywhere, as long as the shell connection is available from your laptop, e.g. kubectl exec, docker exec, or ssh. NoRouter heavily focuses on dev UX and does ...
|
| 2/7/21 |
Kubernetes is becoming the platform of choice for more and more application developers. As applications become more complex and more distributed, they may span multiple Kubernetes clusters, or a combination of Kubernetes and on-premise workloads. While internal traffic within a Kubernetes cluster is handled by the CNI plugin, the external traffic between these workloads, or from workloads to end users, is often carried over a Software Defined Wide Area Network (SD-WAN), which is used for traffic ...
|
| 2/7/21 |
There’s a fast-growing industry trend in the adoption of eBPF to accelerate Kubernetes infrastructure (Cilium, Calico …). AFXDP is a new type of socket that is optimized for high performance packet processing based on eBPF and eXpress Data Path-XDP. XDP allows you to attach an eBPF program to a lower-level hook inside the kernel (aka the NIC Driver). It offers some very promising performance increases for microservices while allowing them to adhere to cloud native design principles. There ...
|
