S C A M P I

1
S C A M P I

• TPM 2004
• Vladimir Smotlacha
• CESNET

2
Project SCAMPI

• SCAMPI SCAleable Monitoring Platform for the
  Internet
• 2 ½ year 5th Framework IST project, started in
  April 2002
• 10 partners from 7 European countries
• Concentrates on passive monitoring
• Should overcome network speed and CPU speed
  ratio by hardware accelerated adapter
• Should allow easy writing of monitoring
  applications

3
Goals of SCAMPI

• Design and development of an open and extensible
  architecture for high-speed network monitoring.
• Development of a high-performance intelligent
  monitoring adapter for speeds upto 10 Gbps.
• Development of unified API for monitoring
  applications - MAPI
• Development of monitoring and measurement
  applications and tools.
• Investigate strategies and methodologies for
  monitoring systems operating at speed higher then
  10 Gbps.

4
SCAMPI architecture
5
Applications and MAPI

• Applications
• Packet capture
• basic application, capturing of selected subset
  of data flow
• Flow statistics
• Threshold alerting for traffic engineering
• QoS monitoring
• Security applications
• DoS detection
• MAPI
• Middleware layer
• Unified access to monitoring capabilities (low
  level drivers)

6
Hardware platforms

• Commodity NIC
• no on-board processing
• difficult timestamping
• DAG cards (Endce, University of Waikato)
• DAG 4.1 - 1 Gb Ethernet, no on-board processing
• DAG 6.x - 10 Gb Ethernet, on-board filtering
• SCAMPI adapter
• based on Combo6 card
• 10 Gb Ethernet
• filtering and advanced data processing

7
COMBO6 card

• Developed by Cesnet and Masaryk University in
  scope of internal project IPv6 HW router
• Partially supported by project 6NET (5th
  Framework IST project)
• Based on VirtexII FPGA
• CAM, RAM module
• Daughter card with link modules (e.g. 4x 1Gb
  Ethernet)
• Packet classification unit in VHDL structure
• packet header (IP, TCP/UDP) transformed to
  unified structure
• CAM part ( width 272 bits, do not care bits)
• processing part (arithmetical and logical
  comparison with 16-bits argument)
• throughput 1 Gbps

8
COMBO6
9
SCAMPI adapter

• Phase I
• COMBO6 card
• 1 Gb Ethernet card
• timestamping card (resolution 10 ns, accuracy
  about 1 ?s with PPS)
• Phase II
• COMBO6X card (64 bit PCI, higher throughput,
  another CAM, ...)
• 10 Gb Ethernet daughter card

10
SCAMPI adapter
11
Timestamp unit

• timestamp format - 64 bit fixed point
• 32 number of seconds (since 1.1.1970)
• 32 fraction of second (precision about 230 ps)
• 100 MHz clock (oscillator 10 MHz, multiplied by
  10)
• TCXO - temperature compensated
• resolution 10 ns
• 64 bytes at rate 10Gb/s 50 ns
• controlled by PPS input (e.g. GPS receiver)
• accuracy (with PPS) 1 us
• accuracy (with NTP) 50 us
• accuracy of calibrated oscillator without PPS
  aging of quartz

12
VHDL blocks

• LUP (look-up processor)
• input classification unit, adopted from IPv6
  router project
• SAU (sampling unit)
• deterministic sampling - each n-th packet is
  passing through
• probabilistic sampling - packet is passing with
  probability 1/n
• STU (statistic unit)
• packets lengths statistic (accumulated length,
  average, variation, min/max)
• statistics of intervals between packets (average,
  variation, min/max)
• PCK (payload checker)
• checks payload for defined pattern (16 byte
  pattern, up to 120 patterns)

13
Conclusion

• SCAMPI adapter advantages
• Advanced functionality on adapter
• Open system, users can download their own
  firmware
• Low cost of 10 Gb/s adapter