prB7 C2 ngo(,( C9G

 6VaT

E L 587

C(C2 C9G

 6VaTx{E L 587

C(C3B7 C2ENLVLMVP LXO 9VPbTMVP F L

TN 4XLVc TCVLW =4<EFB5

 E _ NP 6 OP
S
0 RT S_M N W E9 F4C
 I<78<AF8DBC(+<E4(+4otos(ostrxrxoo)

User A
SwitchRouterInternetServer

Sampling Measurement
User BClientApp LogServerApp LogPacket Capture5,

File A

File B

1S WV3
1SPLO3
1 T VP3S RP1
1M Oc3
1TWR
N2gS
1 M Oc3
1 S WV

File AT VP30P

P K5

TVPKMh3DownloadServer A

User A

DownloadFile B

Server B

6

,kzsu

パケット解析器
File_Aは，File Bのimgファイルをもつhtmlファイルである．
File Aをパケットから再構成

File Bをパケットから再構成

振り分け処理File A

DownloadServer A

User A

DownloadFile B

Server B

,kzsu

パケット解析器
File A

File B

File_Aは，File Bのimgファイルをもつhtmlファイルである．
SocketUserland

Userland

Kernel

KernelSocket

File Aをパケットから再構成
File Bをパケットから再構成
①④✂
✂
②⑤✂
✂
③⑥
振り分け処理NIC

Network

Network

packetize

packetize

File ANIC

DownloadServer A

User A

File B

L4 L7 ⑥L3 L4 L7 ① ･･･ L3 DownloadServer B

8

C4 t
Server A

User A

kklklmklmm
ACK

ll
RTO

Error

lkl

m
ACKm
9

C4 t
Server A

User ATAP 2

TAP 1

kklklmklmm
ACK

ll
RTO

Error

lkltm
ACKvm10

7 KOW

1IPv4 Header031

L3 L4 L7 ①
L3 L4 L7

L3 L7
Server A

MTU1280

MTU1500
User A

Router

Router
MTU1500 Server B

117 KOW

1IPv4 Header

xs0

xs31}zxtz
L3 L4 L7 ①
L3 L4 L7

L3 L7
Server A

MTU1280

MTU1500
User A

Router

Router
MTU1500 Server B

12

ix ,
s



-x

e

N O

ymklwsf <C LO P

 F6C
}
ns

N_Ow
e

N O

f C

X_WMP

{ <C

 <Cs

 F4Ctnoo{ootn13

ix ,symklws-}

exN Of <C LO P F6C

nsN_OeN O



f C



X_WMP{ 

 F4Cw <C <Ctnoso}o otn14}} aT P SL U X7C< B PX7C< MTX LNU 5DB VTMXTO N N
XP 00 LNUP



 TbTL LX_PO Uc S X
P Vo o

LXL PNSoXP 00}

XooLWPo15}}B PX7C<
MTX LNU 5DB
 aT P SL U X7C<!
     VTMXTO N N
XP 00 LNUP



 TbTL LX_PO U
c S X
P Vo o

XP 00}Xooo

LWP    

LXL PNSo16t B K 365t
4 D

 OWS ] (89b ixF6?

 =O X a

=La Oix-8La O=LY[ix8LY[6.(89b -MX O

4B K 365 8 X]Y17

t
t




-x



wx


  18

SF-TAPGASPP[USENIX ATC 2014]nDPI

SCAP[IMC 2012]

l7-ﬁlterlibnids(snort)

libprotoident

フローレベル解析

L7プロトコル判別

トラフィックキャプチャ

netmapPF̲RINGbpf

DPDKpcap
19

C6}xt VTM NL

M



6CG

BE

<C6 <9sx
 T P

NUK LNUP

SL PO WPWv

P Ni

P Ni}
c

WWLup

L K_XTb

P Ni
20

Core Scaling

Core Scaling

Core Scaling

Core Scaling

Analyzer Analyzer Analyzer Analyzer

Analyzer Analyzer Analyzer Analyzer

Analyzer Analyzer Analyzer Analyzer

Analyzer Analyzer Analyzer Analyzer

CPU

CPU

CPU

Flow Abstractor

SF-TAP Cell

CPU

CPU

CPU

CPU

CPU

CPU

Flow Abstractor

CPU

Flow Abstractor

SF-TAP Cell

SF-TAP Cell

CPU

CPU

CPU

CPU

CPU

CPU

Flow AbstractorSF-TAP Cell

Horizontal Scaling
Intra NetworkCell Incubator

The Internet

10GbE
10GbE21Core Scaling
Analyzer Analyzer Analyzer Analyzer
CPUCPUCore Scaling

Core Scaling

Core Scaling

Analyzer Analyzer Analyzer Analyzer

Analyzer Analyzer Analyzer Analyzer

Analyzer Analyzer Analyzer Analyzer

フロー単位での高速ロードバランス
IPフラグメントハンドリング

CPU

Flow Abstractor

SF-TAP Cell

Cell Incubator

CPU

CPU

CPU

CPU

CPU

CPU

Flow Abstractor

CPU

Flow Abstractor

SF-TAP Cell

SF-TAP Cell

CPUCPU

CPU

CPU

CPU

CPU

Flow Abstractor

SF-TAP Cell

Horizontal Scaling
Intra NetworkCell Incubator

The Internet

10GbE
10GbE22

Core Scaling

Core Scaling

Core Scaling

Core Scaling

Analyzer Analyzer Analyzer Analyzer

Analyzer Analyzer Analyzer Analyzer

Analyzer Analyzer Analyzer Analyzer

Analyzer Analyzer Analyzer Analyzer

CPU

CPU

CPU

Flow Abstractor

SF-TAP Cell

CPU

CPU

CPU

CPU

CPU

CPU

Flow Abstractor

CPU

CPU

CPU

CPU

Flow Abstractor

CPU

CPU

Flow Abstractor

SF-TAP Cell

SF-TAP Cell

CPU

SF-TAP Cell

Horizontal Scaling
Intra Network

Flow Abstractor
Cell Incubator

L7プロトコル判別

The Internet

IPフラグメント＆TCPストリーム再構成
10GbE

10GbE

フロー抽象化による非言語依存のIF提供

23

4OUU WM]LK X
M
ouptM:M:M
LNUP Oo:M:M< B 7C7> C9 D<A: A8F 4C

 <X P _ C VVTXR )6 LVP NTXR
< B 4C<{NCOC{N<C O<C244OUU

WM]LK X
uint8_t selector(struct ether* frame) {select_value = hash(ether_frame);
return tap_table[select_value];}
uint8_t hash(struct ether* frame) {struct ip* ip_ptr = ipheader(frame);if ( !fragment ) {return l4hash(ip_ptr);} else {uint16_t key = hash16(ip_ptr->id^ip_ptr->src^ip_ptr->dst);
if ( top_of_fragment_packet ) {fragment_table[key] = l4hash(ip_ptr);
return fragment_table[key];} else {return fragment_table[key];}}

tap_table
tap0
tap1
tap2
tap3
tap0:0xFF

::
tap0
tap1
tap2
tap3}
25

4OUU


 A<6 F4C

WM]LK Xwb K bt<9S PLO{ 9V a<9TX V NU
 NLb
 L T
 6 9 LWP F4Cz{oN26

4OUU

WM]LK X

27

B7 C24OUU
database'/'File'/'syslog'/'etc…''

6Analyzer)Plane)
USER2
USER1
Program Program

yS PLOUSER1&

 P( P PX

M

USER2&UDP(Default(TCP(Default(Loopback(cLWV N
configFile

Flow%Classiﬁer%
TCP/UDP'
Handler'FlowIden)ﬁer

IP#Packet
Defragment
Flow%Abstractor%
NIC$28B7 C24OUU

 9V a 4M

LN

database'/'File'/'syslog'/'etc…''

wAnalyzer)Plane)
USER2
USER1
Program Program 4XLVc P

CVLXP



USER1&config
File

USER2&UDP(Default(TCP(Default(

Loopback(Flow%Classiﬁer%
TCP/UDP'
Handler'FlowIden)ﬁer

IP#Packet
Defragment
Flow%Abstractor%
NIC$29B7 C2

4OUU

7UX_ 2L[

 NL

KM X
database'/'File'/'syslog'/'etc…''

XP WL

Pb P TWPX LVAnalyzer)Plane)
USER2
USER1
Program Program



 F6C

 <C



USER1&config
File

D<A:

 NL
TX V NU
 N XOT T X V NU

USER2&UDP(Default(TCP(Default(

Loopback(Flow%Classiﬁer%
TCP/UDP'
Handler'FlowIden)ﬁerIP#Packet
Defragment
Flow%Abstractor%
NIC$30B7 C24OUU

7UX_ 2L[<9database'/'File'/'syslog'/'etc…''

 9V a <7Analyzer)Plane) <C LOO P

N _X
S



PLW

_ O aX





PLW
PLW

KM X

USER2
USER1
Program Program

USER1&config
File

USER2&UDP(Default(

TCP(Default(

Loopback(

Flow%
Classiﬁer%
TCP/UDP'
Handler'FlowIden)ﬁer

IP#Packet
Defragment
Flow%Abstractor%
NIC$31

B7 C24OUU

7UX_ 2L[ GXTb 7 WLTX E NUPTVP 7P L_VAnalyzer)Plane)
USER2
USER1
Program Program

<9

database'/'File'/'syslog'/'etc…''<9 N X TR

KM Xs}

 F6C
 G7C

USER1&config
File

MLNU <9p

V a LMLN

USER2&UDP(Default(TCP(Default(

Loopback(

Flow%
Classiﬁer%
TCP/UDP'
Handler'FlowIden)ﬁerq XP NL
T Po
NLpx

IP#Packet
Defragment
Flow%Abstractor%
NIC$32

B7 C2

4OUU

7UX_ 2L[KM X

4XWPS

7SUO

flow-abstractor/examplesから一部抜粋

33

B7 C2

4OUU

7UX_ 2L[KM X

7t

9V a}

pdatabase'/'File'/'syslog'/'etc…''

Analyzer)Plane)
USER2
USER1
USER1
USER1 USER1
Program Program Program Program Program

USER1&USER1&USER1& USER1&

USER2&UDP(Default(TCP(Default( Loopback(Flow%Classiﬁer%
TCP/UDP'
Handler'FlowIden)ﬁer
IP#Packet
Defragment
Flow%Abstractor%

NIC$34

B7 C24OUU 7UX_ 2L[ KM X

X] LO

flow-abstractor/examples
から一部抜粋

35

実行後

36

RYPPPP KXLWPP KXLWPP KXLWPP P KXLWP<C 4OO P<C 4OO P37

RY<C 4OO P<C 4OO P<C 4OO P<C 4OO P((<C 4OO P<C 4OO P(<C 4OO P<C 4OO P(EPP

ALWP38B7 C2 t 6EH

UPc

LV_P

ip1=192.168.24.54,ip2=216.58.221.196,port1=59547,port2=80,hop=0,l3=ipv4,l4=tcp,event=CREATED{“ip1”: “192.168.24.54”,“ip2”: “216.58.221.196”,“port1”: 59547,“port2”: 80,“hop”: 0,“l3”: “ipv4”,“l4”: “tcp”,“event”: “CREATED”}
39

6 OW
When arriving data, DATA event is invoked.

DATA
CREATED

DESTROYEDEROW C4 MXWWOM SXW S[ O[ KLUS[RON
YO PX ON ( _Ka RKWN[RKTO
4A62C65O OW S[ SW XTON
C4 MXWWOM SXW S[ NO[ XaONOMOS ON
56BCA?G65 EROW
7ABC XS OX]56BCA?G65 O OW S[SW XTON

4A62C6540

5K K

P X

SY 0 .
- ) ) SY 0. YX
0 . ), YX
0XY0 U(0SY ) U)0 MY O OW 052C2 P X 0K MR0NX_W UOW0).)SPLOPP PX 274F4 VPX2 /OL L/ Mc P

RX[SYRRX[YXSYNK K P X

RX[NK K P X

RX[YX41

5K K]Y[OK

NX_W[OKConfiguration
http:up: '^[-a-zA-Z]+ .+ HTTP/1\.(0\r?\n|1\r?\n([-a-zA-Z]+: .+\r?\n)+)'down: '^HTTP/1\.[01] [1-9][0-9]{2} .+\r?\n'proto: TCP # TCP or UDP
if: http # file name of UNIX domain socket
format: text # text or binary
body: yes # if specified 'no', only header is output

Matched with the pattern of downstream
ip1=192.168.24.54,ip2=216.58.221.196,port1=59547,port2=80,hop=0,l3=ipv4,l4=tcp,ev
ent=DATA,from=2,match=down,len=494
Matched with the pattern of upstream
ip1=192.168.24.54,ip2=216.58.221.196,port1=59547,port2=80,hop=0,l3=ipv4,l4=tcp,event=DATA,from=1,match=up,len=78

42

t
MXWWOM[ 0 [XMTOMXWWOM [X [XMTO/e
Y [PKY

MY R

Yf /

PX

// c
OKN ROKNO
OKNUSWO [ USWO /R 0 YK [O ROKNO USWO /OWO K O [O[[SXW 5[SN 0 WO_ [O[[SXW 5 RHeSY fI RHeSY fIRHeYX
fI RHeYXfIRHeRXYfI /SPdd

RHeO OW fI 00 e52C2f c
OKN [ L]P RHeUOWfI /KWKUa[S[ Y XMO[[ L]P RHeUOWfI /43

L

RT S_Moon}
44

7UX_ 2L[KM X

<96CGPW
BE0 JP X 8- .)c0 77D)+F50 GM_X _t}(NUP XPV )P ( (:Sd,0 N_ V V LOP(a) HTTP Analyzer x 1(b) HTTP Analyzer x 2(c) HTTP Analyzer x 4

generate 50 clients / sec, 1000 clients maximum, 2500 requests / sec on average

Figure 7: CPU Load of HTTP Analyzer and Flow Abstractor

45

ents maximum, 2500 requests / sec on average

7UX_ 2L[KM X

tHTTP Analyzer and Flow Abstractor
EPN4k}

10k

NL

50k

46

4OUU

WM]LK XtF)(
6CG0 JP X 8+ ( 8 0 ,:5BE 0 9 PP5E7N

P (:Sd47

4OUU

WM]LK Xt

F)(
6CG0 JP X 8+ ( 8 0 ,:5BE 0 9 PP5E7N

P (:Sd48

4OUU

WM]LK Xt

理論値ideal(1) α->γ(2) α->β(3) α->β(3) α->γ16mirror

12Mppsbridge only

8ix0 -> ix1ix0 -> igbX

4064

128

256

fragment size (bytes)

5121024

49

4OUU
 6CGWM]LK X

 M TORPV at
P L L P

6CG +50

B7 C2 t
 6 4>D4
 FST O CEF( 

L

PX P



c IPM F LNUTXR<AF8DBC( + PVL

AFF

TN

PL NSzUTMLXL
51

492;A2
 FST OLc IPM F LNUTXR

52

492;A2

X SO

53

,BOW[O[ TP B PX9V a 0 B PX EaT NS
N X
VVP 0 c_L
 7C< 0P
 6:A 0 XL

q7senses (L7 Network Control System) User Portal
Redis-APISDN Controller
Redis-API

Network Selector

Video Stream Notifier

vISP BackBone Network 
Low-Spped-Link
using NetEm

User AUser B

Internal-OFS

Portal System

SF-TAP

External-OFS

CGNInternet

High-Spped-Link

54

E 56

>TMLXL8VL

TN EPL NSFFC>TMLXL8VL

TN EPL NS

FFC 4XLVc P
9V a 4M

LN55

gvr

 EE


{V a LM C6 7ED

 E< 7{LN}tAP aFEJ}U<9VLM LVV NLNc}56h{ySn0L}

RT S_M Tooo}

57