High speed data packet flow processing
An embodiment may involve a network interface configured to capture data packets into a binary format and a non-volatile memory configured to temporarily store the data packets received by way of the network interface. The embodiment may also involve a first array of processing elements each configured to independently and asynchronously: (i) read a chunk of data packets from the non-volatile memory, (ii) identify flows of data packets within the chunk, and (iii) generate flow representations for the flows. The embodiment may also involve a second array of processing elements configured to: (i) receive the flow representations from the first array of processing elements, (ii) identify and aggregate common flows across the flow representations into an aggregated flow representation, (iii) based on a filter specification, remove one or more of the flows from the aggregated flow representation, and (iv) write information from the aggregated flow representation to the database.
1. A system comprising:
a network interface module configured to capture data packets into a binary format;
non-volatile memory configured to temporarily store the data packets received by way of the network interface module in the binary format;
an interface to a database;
a first plurality of processors, each configured to independently and asynchronously perform a first set of operations that involve: (i) reading a chunk of data packets from the non-volatile memory, (ii) identifying flows of the data packets within the chunk, (iii) generating flow representations for the flows, wherein the flow representations are in an intermediate format that aggregates header information and metadata associated with the data packets respectively corresponding to the flows, and (iv) periodically flushing the flow representations for further processing; and
a second plurality of processors, each configured to perform a second set of operations in parallel to the first set of operations, wherein the second set of operations involve: (i) receiving the flow representations flushed by the first plurality of processors, (ii) identifying and aggregating common flows across the flow representations received from different processors of the first plurality of processors into an aggregated flow representation, (iii) based on a filter specification, removing one or more of the flows from the aggregated flow representation, and (iv) writing, by way of the interface, information from the aggregated flow representation to the database.
2. The system of claim 1 , wherein identifying the flows comprises:
identifying, as the flows, respective subsets of the data packets within the chunk that have particular combinations of header field values; and
representing each of the flows as an entry in the intermediate format.
3. The system of claim 1 , wherein the header information is from one or more of data link layer, network layer, and transport layer fields.
4. The system of claim 3 , wherein the header information comprises data link addresses, network addresses, or transport layer port numbers.
5. The system of claim 1 , wherein the metadata associated with the data packets include one or more of a count of the data packets or a count of bytes in the data packets, a device identifier for the system, or a physical port through which the data packets were received by the system.
6. The system of claim 1 , wherein aggregating the common flows across the flow representations into the aggregated flow representation comprises summing respective packet counts or byte counts from the common flows in the aggregated flow representation.
7. The system of claim 1 , wherein identifying flows of the data packets within the chunk comprises calculating, based on header field values of the data packets within the chunk, respective hash values, wherein the hash values uniquely denote respective flows to which the data packets belong.
8. The system of claim 1 , wherein a further plurality of processors read the data packets from the network interface module in hard real-time with latencies within a first threshold.
9. The system of claim 8 , wherein the first set of operations and the second set of operations are performed in soft real-time with average latency within a second threshold, wherein the second threshold is greater than the first threshold.
10. The system of claim 1 , wherein different processors of the second plurality of processors perform operations each of: identifying and aggregating the common flows, removing the one or more of the flows from the aggregated flow representation, and writing the information from the aggregated flow representation to the database.
11. The system of claim 1 , wherein the filter specification passes the flows that match a whitelist or the filter specification passes the flows that are in a set of top m flows in terms of number of the data packets or number of bytes, wherein m is between 1 and 10,000.
12. The system of claim 1 , wherein the network interface module is configured to:
receive n packets;
capture 1 of the n packets; and
transmit n−1 of the n packets to a subsequent packet capture system that is arranged in series with the system.
13. The system of claim 1 , further comprising:
a further plurality of processors configured to provide a virtual machine, wherein a packet processing application is executable on the virtual machine, and wherein a zero copy forwarding buffer allows the packet processing application to read the data packets from the non-volatile memory without packet loss.
14. A computer-implemented method comprising:
performing, by each of a first plurality of processors and in an independent and asynchronous fashion, a first set of operations that involve: (i) reading a chunk of data packets from a non-volatile memory, wherein the data packets were received by way of a network interface module in a binary format, and wherein the non-volatile memory is configured to temporarily store the data packets, (ii) identifying flows of the data packets within the chunk, (iii) generating flow representations for the flows, wherein the flow representations are in an intermediate format that aggregates header information and metadata associated with the data packets respectively corresponding to the flows, and (iv) periodically flushing the flow representations for further processing; and
performing, by each of a second plurality of processors, a second set of operations in parallel to the first set of operations, wherein the second set of operations involve: (i) receiving the flow representations flushed by the first plurality of processors, (ii) identifying and aggregating common flows across the flow representations received from different processors of the first plurality of processors into an aggregated flow representation, (iii) based on a filter specification, removing one or more of the flows from the aggregated flow representation, and (iv) writing, by way of an interface, information from the aggregated flow representation to a database.
15. A system comprising:
a network interface module configured to capture data packets into a binary format;
non-volatile memory configured to temporarily store the data packets received by way of the network interface module in the binary format;
an interface to a database;
a first plurality of processors, each configured to independently and asynchronously perform a first set of operations that involve: (i) reading a chunk of the data packets from the non-volatile memory, (ii) filtering the data packets within the chunk so that a subset of the data packets remain, (iii) reading a content specification for a particular type of the data packets, wherein the content specification indicates how to construct unique transaction keys for the particular type, and (iv) decoding the data packets in the subset from the binary format to an intermediate format based on the content specification, wherein the intermediate format includes a transaction key; and
a second plurality of processors, each configured to perform a second set of operations in parallel to the first set of operations, wherein the second set of operations involve: (i) receiving the data packets as decoded by the first plurality of processors, (ii) storing, in a hash table indexed by the transaction key, the data packets as decoded in the intermediate format, (iii) reading the data packets as stored, (iv) analyzing the data packets as read to identify a pre-determined set of characteristics, and (v) writing, by way of the interface, the characteristics identified by the analysis to the database.
16. The system of claim 15 , wherein the content specification defines an arrangement of fields within the particular type, and wherein the transaction key is based on values from one or more of the fields.
17. The system of claim 15 , wherein decoding the data packets in the subset from the binary format to the intermediate format comprises:
converting the content specification to a table that can be programmatically introspected;
mapping values of fields of the data packets in the subset to entries in the table; and
converting the entries in the table to the intermediate format.
18. The system of claim 15 , wherein the pre-determined set of characteristics includes timing characteristics, packet count characteristics, byte count characteristics, or values in fields of the data packets as read.
19. The system of claim 15 , wherein a further plurality of processors read the data packets from the network interface module in hard real-time with latencies within a first threshold.
20. The system of claim 15 , wherein the network interface module is configured to:
receive n packets;
capture 1 of the n packets; and
transmit n−1 of the n packets to a subsequent packet capture system that is arranged in series with the system.