the ninja box (and bart) [email protected] centre for...

Test and Measurement withthe Ninja box (and BART)

David Hayes

[email protected]

Centre for Advanced Internet Architectures (CAIA)Swinburne University of Technology

Outline

Introduction - Test and Measurement in CAIAWhat is the Ninja Box?4.5G2 DAG cards

Clock SynchronisationData Stream ManagementBasic CaptureBasic Traffic Generation

Simple ExperimentSetupResults

Port Mirroring DelaysConclusionsThanks

Caia Seminar http://www.caia.swin.edu.au [email protected] 12 March, 2009 2

IntroductionTest and Measurement in CAIA

Test and Measurement of various network characteristics isa vital part of CAIA’s research.The Endace Ninja Box(http://www.endace.com/ninjabox.html) willenhance our traffic measurement and traffic generationcapabilities.This talk will outline the Ninja Box capabilities in conjunctionwith:

The Broadband Access Research Testbed (BART)http://caia.swin.edu.au/bart/The Synthetic Packet Pair (SPP) tool for passive Round TripTime (RTT) measurement.http://caia.swin.edu.au/tools/spp/


What is the Ninja Box?

Server grade machine, optimised for packet captureOur Configuration:

2× 2 GHz Intel(R) Xeon(R) core 2 duoLinux kernel 2.6.18, Centos OS, 4G ram2TB disk (8 disk raid)2×DAG 4.5G2 – Precision packet capture cards

http://www.endace.com/ninjabox.html


4.5G2 DAG cardsData Stream ManagementInline ForwardingTimed Release ERF

Endace, “Dag 4.5 G2 Card User Guide”, 2008, p3


DAG Clock Synchronisation

Geographically separated measurementsSynchronise with GPS

We currently synchronise DAD 0 to the PC clock

Dag cards synchronised to each otherPC is synchronised by NTPDAG cards synchronised to PC by DUCK


DAG Clock Synchronisation

Geographically separated measurementsSynchronise with GPS

We currently synchronise DAD 0 to the PC clockDag cards synchronised to each otherPC is synchronised by NTPDAG cards synchronised to PC by DUCK


DAG Data Stream Management

Filter/load balancingPacket colourising and droppingPacket steering


DAG Data Stream Management

Packets are received fromone or both portsEither:

Use inbuilt loadbalancing classifierOr Classify (and drop)based on programmablefilters

Colourise (based on aboveresult)Steer to stream buffer

2Rx and 1Tx per DAG)

Steering can includeduplication

Endace, “Enhanced Packet Processing

Software Guide”, 2008, p3


Basic Capture

dagsnap — high speed capture (erf)packets from a previous capture session

Post process if necessary (WAND libtrace (http://research.wand.net.nz/software/libtrace.php)

traceanontracefiltertracesplittracemerge

dagconvert — change format (ie to pcap)


Basic Traffic Generation

daggenConfiguration file to describe trafficAddresses can be randomPayloads can vary, deterministically or randomlyOutputs ERF format file (or can go direct to DAG)

dagfloodSends ERF fileTo flood link: dagconfig nodelayFor timed replay: dagconfig relative


Simple Experiment

Objective

Familiarity with:NinjaBox (http://www.endace.com/ninjabox.html),BART (http://caia.swin.edu.au/bart/),and SPP (http://caia.swin.edu.au/tools/spp/)

Compare NinjaBox and PC based tcpdump(http://www.tcpdump.org/) captures


Setup

ADSL Modem

BART

SWIN

Mirrored ports

BA

Workgroup Switch

CatalystCiscoSystems

MeasureRTTA→←↩Bfor scpA→ B


Results RTT A→←↩B

0

0.2

0.4

0.6

0.8

1

1.2

1.4

1.6

1.8

0 50 100 150 200 250

RTT

(s)

Time since first captured packet (s)

NinjaBoxTcpDump

ObservationsTCP sawtooth


Results RTT A→←↩B — Zoom

1

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.8

151.5 152 152.5 153 153.5 154

RTT

(s)


NinjaBoxTcpDump

Observations100MbpsburstAck clockedRx TCP Ackswhile awaitingssh response



1

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.8

151.744 151.744 151.745 151.745 151.746 151.746 151.747 151.747 151.748 151.748 151.749

RTT

(s)


NinjaBoxTcpDump

ObservationsPcap timestamp – time kernel saw packet,Not time sent on the wireDag timestamp – mirrored



1.23

1.2305

1.231

1.2315

1.232

151.745 151.745 151.745 151.746 151.746 151.746 151.746 151.746 151.746 151.746 151.746

RTT

(s)


NinjaBoxTcpDump

ObservationsLocal tcpdump overestimatesRTT


Port Mirroring Delays

UP direction

∆tup = τrx + τAin + τcopy + τMout

Perturbation depends on:

Packet sizeSwitch loadFull duplex utilisation

Switch

A

B

M


Port Mirroring Delays

UP direction

∆tup = τrx + τAin + τcopy + τMout

DOWN direction

∆tdown = τcopy + (τMout − τAout)

Perturbation depends on:Packet sizeSwitch loadFull duplex utilisation

Switch

A

B

M


Conclusions

Ninjabox will provide increased test and measurementcapabilities for CAIASPP is a great tool for RTT calculationWhen very accurate timing is required:

Care should be taken with the DAG clock synchronisationCare should be taken with how the packets are captured


Thanks

JasonAmielLawrence


the ninja box (and bart) [email protected] centre for...

Documents