Survey
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
RTC-Mon Enabling High-Speed and Extensible Real-Time Communications Monitoring Diego Costantini, Felipe Huici [costantini|huici]@nw.neclab.eu September 2008 - 1 Motivation • Internet as medium for real-time communications like VoIP has grown significantly over the past years • However best-effort model not well-suited to these sort of applications • Need real-time monitoring in order to – ensure good service quality – take corrective action should service degradation occur September 2008 - 2 Monitoring Difficulties • Real-time monitoring is difficult – System often has to correlate signaling and media streams – Connections tend to use dynamic ports – Monitoring in real-time results in non-trivial performance requirements In the case of VoIP, the abundance of small packets exacerbates this problem September 2008 - 3 State of the Art • Current software solutions insufficient – Limited monitoring capabilities, not easy to extend – Long development time – Not efficient enough to track traffic in real-time • Hardware solutions are inflexible and hard to extend • Need a general monitoring framework that – provides basic VoIP monitoring capabilities in order to reduce development time – is easily extensible – is efficient enough to cope with demands of real-time traffic monitoring September 2008 - 4 •Proof-of-concept monitoring application •Small, quick to develop (800 lines of code) •Can track numerous VoIP statistics September 2008 - 5 custom application libvoip libpfring SIP plugin RTP plugin custom plugin extended PF_RING network interfaces KERNEL SPACE •Also implemented VoIP Console VoIP console USER SPACE •Extended PF_RING with plugin architecture •SIP and RTP plugins •Event-based user-level library RTC-MON FRAMEWORK •Implemented over Linux •Consists of: APPS RTC-Mon: The Real-Time Communications Monitor Framework – Linux kernel module providing new type of socket – Yields high performance – Can be used with any network card • Extended PF_RING – Has plugin architecture – Includes IP defragmentation September 2008 - 6 APPS RTC-MON FRAMEWORK libvoip libpfring SIP plugi n RTP plugi n extended PF_RING network interfaces custom plugin KERNEL SPACE • PF_RING custom application USER SPACE Extended PF_RING VoIP console • • APPS RTC-MON FRAMEWORK libvoip libpfring SIP plugi n Each PF_RING socket has set of rules – Processed sequentially Each rule has – a filter – a plugin ID to send packets to – an action ID which decides what to do after plugin processes packet Filter can be hash or wild-card based – Hash: can be used to track flows (RTP plugin) – Wildcard: more flexible (match all UDP packets to one port) September 2008 - 7 RTP plugi n extended PF_RING network interfaces custom plugin KERNEL SPACE • custom application USER SPACE Extended PF_RING VoIP console APPS custom application • User-level, event-based library • Extensible, can support other, non-VoIP applications • Made of a dispatcher and trackers libpfring SIP plugi n RTP plugi n custom plugin extended PF_RING network interfaces – Dispatcher receives packets from plugins and decides which trackers to send them to – Trackers Combine information from several plugins to monitor a specific characteristic of the traffic Can perform further analysis, parsing and can keep state Library is extended by writing custom trackers September 2008 - 8 KERNEL SPACE RTC-MON FRAMEWORK libvoip USER SPACE Libvoip VoIP console APPS custom application libpfring SIP plugi n RTP plugi n custom plugin extended PF_RING network interfaces • Implemented two trackers – UserTracker, uses SIP information to keep track of SIP users – CallTracker, combines SIP/RTP data to monitor call information September 2008 - 9 KERNEL SPACE RTC-MON FRAMEWORK libvoip USER SPACE Libvoip VoIP console APPS • Proof-of-concept monitoring application libpfring SIP plugi n RTP plugi n custom plugin extended PF_RING network interfaces – Only 800 lines of code, short development time – Uses UserTracker, CallTracker and SIP/RTP plugins • Despite small size, can still track large number of statistics September 2008 - 10 KERNEL SPACE RTC-MON FRAMEWORK libvoip USER SPACE VoIP Console custom application VoIP console APPS custom application libpfring SIP plugi n RTP plugi n custom plugin extended PF_RING network interfaces • IXIA 400 generates up to 50,000 concurrent trash UDP flows • VoIP traffic generator replays VoIP trace – Trace has 1,000 calls each lasting 30 seconds September 2008 - 11 Codec Sample Size (bytes) Sample Rate (ms) Max Num Flows (Gb link) G.711 80 10 11,468 G.726 20 5 18,116 G.726 15 5 21,186 G.728 10 5 31,780 G.729 10 10 32,051 iLBC 38 20 36,101 G.723.1 24 30 45,732 G.723.1 20 30 48,077 KERNEL SPACE RTC-MON FRAMEWORK libvoip USER SPACE Evaluation: Testbed VoIP console APPS RTC-MON FRAMEWORK libvoip libpfring SIP plugi n RTP plugi n custom plugin extended PF_RING network interfaces – puts larger strain on system than SIP • Measure improvement in CPU usage from performing data analysis in kernel September 2008 - 12 KERNEL SPACE • Focus is on RTP traffic custom application USER SPACE Performance VoIP console September 2008 - 13 APPS RTC-MON FRAMEWORK libvoip libpfring SIP plugi n RTP plugi n extended PF_RING network interfaces custom plugin KERNEL SPACE • Measure monitoring performance for 50,000 flows and varying number of RTP rules (flows) custom application USER SPACE Performance VoIP console libpfring RTP plugi n SIP plugi n extended PF_RING APPS network interfaces # Rules Avg. Ins. (usec) Max. Ins. (usec) Avg. Del. (usec) Max. Del. (usec) 10,000 20.9 98 4.7 81 20,000 22.3 130 5.3 95 30,000 25.2 210 7.9 150 40,000 27.9 379 12.7 22.5 50,000 47.1 2037 19.1 52.7 • In worst-case (2 msec) a single G.711 or G.729 packet would go untracked custom plugin KERNEL SPACE RTC-MON FRAMEWORK libvoip • Rule reconfiguration times September 2008 - 14 custom application USER SPACE Performance VoIP console Conclusions • Presented RTC-Mon – Framework for quickly developing real-time monitoring applications – Easily extensible, can support future applications – Performs well even under heavy loads and small packet sizes • Future work – Additional plugins (RTSP, RTCP, MPEG-7?) – Distributed monitoring Track SIP/RTP flows traversing different paths September 2008 - 15