Fast xFlow Proxy: Exploring and Visualizing Deep Inside of Carrier Traffic

This paper proposes a fast and scalable traffic monitoring system called Fast xFlow Proxy. For efficiently provisioning and operating networks, xFlow such as IPFIX and NetFlow is a promising technology for visualizing the detailed traffic matrix in a network. However, internet protocol (IP) packets in a large carrier network are encapsulated with various outer headers, e.g., layer 2 tunneling protocol (L2TP) or multi-protocol label switching (MPLS) labels. As native xFlow technologies are applied to the outer header, the desired inner information cannot be visualized. From this motivation, we propose Fast xFlow Proxy, which explores the complicated carrier's packet, extracts inner information properly, and relays the inner information to a general flow collector. Fast xFlow Proxy should be able to handle various packet processing operations possible (e.g., header analysis, header elimination, and statistics) at a wire rate. To realize the processing speed needed, we implement Fast xFlow Proxy using the data plane development kit (DPDK) and field-programmable gate array (FPGA). By optimizing deployment of processes between DPDK and FPGA, Fast xFlow Proxy achieves wire rate processing. From evaluations, we can achieve over 20 Gbps performance by using a single server and 100 Gbps performance by using scale-out architecture. We also show that this performance is sufficiently practical for monitoring a nationwide carrier network.