# SmartX Multi-View Visibility Framework
## 3 SmartX MVF with Flow-Centric Visibility: Design and Implementation
### Network Packet-Precise Collection  
As mentioned in the requirements section, we required a special visibility agent that should collect the network packets from each network interface of SmartX box. IO Visor [37] is an open-source project designed to accelerate the innovation, development, and sharing of virtualized kernel input/output (I/O) services for networking, security, and tracing. It extends the networking capabilities based on extended Berkeley packet filter (eBPF) [38], which exists in the Linux upstream kernel version 4.x or later. eBPF is a small virtual machine that runs programs inserted from the user-space and attached to specific hooks in the kernel. It is used on Linux to filter packets and avoid expensive copies to user-space, for instance with tcpdump. IO Visor extends the capability by providing a BPF compiler collection (BCC) tool for executing eBPF instruction from other high-level languages, such as Python. By executing IO visor-based packet tracing, we can either trace the entire packet payload or check only specific packet headers by leveraging the eBPF feature.  
By employing eBPF and IO Visor, we developed a visibility agent that collects information about each packet with a small number of CPU cycles because it directly accesses raw packets, copied from NIC to receive ring buffer. Considering SmartX box network interface types, we created two functions: ip_filter and vxlan_filter. Ip_filter collects packet header information such as five-tuples (IP source, IP destination, protocol, TCP/UDP source port, TCP/UDP destination port), TCP window size, and associated number of bytes. Vxlan_filter collects packets header information such as nine-tuples (host IP source, host IP destination, host protocol, guest IP source, guest IP destination, VLAN ID, guest protocol, guest TCP/UDP source port, guest TCP/UDP destination port), guest TCP window size, and associated number of bytes. The overall design of visibility agent is shown in Figure 4.  
Before IO visor-based packet tracing and collection can be enabled in the SmartX box, the kernel should be upgraded to the kernel version 4.4.x and BCC tools/libraries should be installed. To ensure the automated recovery of visibility agent, it is created as a Linux system service. Our implementation of IO visor-based tracing code collects packet data from all the network interfaces of SmartX box by attaching our user-space program into Linux networking socket and then starts filtering packet data based on the filter definition (e.g., 0x0800 is IP packet) inside our program. Kernel networking I/O sends matched packets in bytecode to a user-space program. The second implementation is a user-space tracing program written in Python. The program is hooked into a Linux networking socket through  
Figure 3: The overall architecture of SmartX MVF with the extension of flow-centric visibility.  
python socket programming. It acquires all raw packets from that socket and translates them into byte arrays. Finally by scanning, it extracts five-tuples or nine-tuples information from the whole byte array. A timestamp field is added to the extracted header fields of the packet and sent to DataLake by using the data delivery method specified at the visibility agent startup.