Transcript SNMP Management Interface to ngRNC

RTC-Mon
Enabling High-Speed and Extensible Real-Time
Communications Monitoring
Diego Costantini, Felipe Huici
[costantini|huici]@nw.neclab.eu
September 2008 - 1
Motivation
• Internet as medium for real-time communications like VoIP
has grown significantly over the past years
• However best-effort model not well-suited to these sort of
applications
• Need real-time monitoring in order to
– ensure good service quality
– take corrective action should service degradation occur
September 2008 - 2
Monitoring Difficulties
• Real-time monitoring is difficult
– System often has to correlate signaling and media streams
– Connections tend to use dynamic ports
– Monitoring in real-time results in non-trivial performance
requirements
 In the case of VoIP, the abundance of small packets exacerbates
this problem
September 2008 - 3
State of the Art
• Current software solutions insufficient
– Limited monitoring capabilities, not easy to extend
– Long development time
– Not efficient enough to track traffic in real-time
• Hardware solutions are inflexible and hard to extend
• Need a general monitoring framework that
– provides basic VoIP monitoring capabilities in order to reduce
development time
– is easily extensible
– is efficient enough to cope with demands of real-time traffic
monitoring
September 2008 - 4
•Proof-of-concept monitoring application
•Small, quick to develop (800 lines of
code)
•Can track numerous VoIP statistics
September 2008 - 5
custom
application
libvoip
libpfring
SIP
plugin
RTP
plugin
custom
plugin
extended
PF_RING
network interfaces
KERNEL SPACE
•Also implemented VoIP Console
VoIP
console
USER SPACE
•Extended PF_RING with plugin
architecture
•SIP and RTP plugins
•Event-based user-level library
RTC-MON FRAMEWORK
•Implemented over Linux
•Consists of:
APPS
RTC-Mon: The Real-Time Communications Monitor
Framework
– Linux kernel module providing new type of socket
– Yields high performance
– Can be used with any network card
• Extended PF_RING
– Has plugin architecture
– Includes IP defragmentation
September 2008 - 6
APPS
RTC-MON FRAMEWORK
libvoip
libpfring
SIP
plugi
n
RTP
plugi
n
extended
PF_RING
network interfaces
custom
plugin
KERNEL SPACE
• PF_RING
custom
application
USER SPACE
Extended PF_RING
VoIP
console
•
•
APPS
RTC-MON FRAMEWORK
libvoip
libpfring
SIP
plugi
n
Each PF_RING socket has set of rules
– Processed sequentially
Each rule has
– a filter
– a plugin ID to send packets to
– an action ID which decides what to do after plugin processes packet
Filter can be hash or wild-card based
– Hash: can be used to track flows (RTP plugin)
– Wildcard: more flexible (match all UDP packets to one port)
September 2008 - 7
RTP
plugi
n
extended
PF_RING
network interfaces
custom
plugin
KERNEL SPACE
•
custom
application
USER SPACE
Extended PF_RING
VoIP
console
APPS
custom
application
• User-level, event-based library
• Extensible, can support other, non-VoIP applications
• Made of a dispatcher and trackers
libpfring
SIP
plugi
n
RTP
plugi
n
custom
plugin
extended
PF_RING
network interfaces
– Dispatcher
 receives packets from plugins and decides which trackers to send
them to
– Trackers
 Combine information from several plugins to monitor a specific
characteristic of the traffic
 Can perform further analysis, parsing and can keep state
 Library is extended by writing custom trackers
September 2008 - 8
KERNEL SPACE
RTC-MON FRAMEWORK
libvoip
USER SPACE
Libvoip
VoIP
console
APPS
custom
application
libpfring
SIP
plugi
n
RTP
plugi
n
custom
plugin
extended
PF_RING
network interfaces
• Implemented two trackers
– UserTracker, uses SIP information to keep track of SIP users
– CallTracker, combines SIP/RTP data to monitor call
information
September 2008 - 9
KERNEL SPACE
RTC-MON FRAMEWORK
libvoip
USER SPACE
Libvoip
VoIP
console
APPS
• Proof-of-concept monitoring application
libpfring
SIP
plugi
n
RTP
plugi
n
custom
plugin
extended
PF_RING
network interfaces
– Only 800 lines of code, short development time
– Uses UserTracker, CallTracker and SIP/RTP plugins
• Despite small size, can still track large number of statistics
September 2008 - 10
KERNEL SPACE
RTC-MON FRAMEWORK
libvoip
USER SPACE
VoIP Console
custom
application
VoIP
console
APPS
custom
application
libpfring
SIP
plugi
n
RTP
plugi
n
custom
plugin
extended
PF_RING
network interfaces
• IXIA 400 generates up to 50,000 concurrent trash UDP flows
• VoIP traffic generator replays VoIP trace
– Trace has 1,000 calls each lasting 30 seconds
September 2008 - 11
Codec
Sample
Size
(bytes)
Sample
Rate
(ms)
Max Num
Flows
(Gb link)
G.711
80
10
11,468
G.726
20
5
18,116
G.726
15
5
21,186
G.728
10
5
31,780
G.729
10
10
32,051
iLBC
38
20
36,101
G.723.1
24
30
45,732
G.723.1
20
30
48,077
KERNEL SPACE
RTC-MON FRAMEWORK
libvoip
USER SPACE
Evaluation: Testbed
VoIP
console
APPS
RTC-MON FRAMEWORK
libvoip
libpfring
SIP
plugi
n
RTP
plugi
n
custom
plugin
extended
PF_RING
network interfaces
– puts larger strain on system than SIP
• Measure improvement in CPU usage from performing data
analysis in kernel
September 2008 - 12
KERNEL SPACE
• Focus is on RTP traffic
custom
application
USER SPACE
Performance
VoIP
console
September 2008 - 13
APPS
RTC-MON FRAMEWORK
libvoip
libpfring
SIP
plugi
n
RTP
plugi
n
extended
PF_RING
network interfaces
custom
plugin
KERNEL SPACE
• Measure monitoring performance for 50,000
flows and varying number of RTP rules (flows)
custom
application
USER SPACE
Performance
VoIP
console
libpfring
RTP
plugi
n
SIP
plugi
n
extended
PF_RING
APPS
network interfaces
# Rules
Avg. Ins.
(usec)
Max. Ins.
(usec)
Avg. Del.
(usec)
Max. Del.
(usec)
10,000
20.9
98
4.7
81
20,000
22.3
130
5.3
95
30,000
25.2
210
7.9
150
40,000
27.9
379
12.7
22.5
50,000
47.1
2037
19.1
52.7
• In worst-case (2 msec) a single G.711 or G.729 packet
would go untracked
custom
plugin
KERNEL SPACE
RTC-MON FRAMEWORK
libvoip
• Rule reconfiguration times
September 2008 - 14
custom
application
USER SPACE
Performance
VoIP
console
Conclusions
• Presented RTC-Mon
– Framework for quickly developing real-time monitoring
applications
– Easily extensible, can support future applications
– Performs well even under heavy loads and small packet sizes
• Future work
– Additional plugins (RTSP, RTCP, MPEG-7?)
– Distributed monitoring
 Track SIP/RTP flows traversing different paths
September 2008 - 15