User login

Blogs

01

May

2017

Another disrupted week, this time due to being ill. Spent most of my available time looking over the output of my new multi-process state machine generation algorithm. The extra sequence fragments that become apparent when considering multiple processes managed to reveal a few new situations where my code wasn't quite doing the right thing. I've fixed those and am reasonably happy again with the machines produced for my test dataset.

Moved on to some code re-factoring, as the existing code-base had become a bit of a mess from hacking in fixes to all of the edge cases I had been dealing with. In particular, I'm aiming to separate code that deals with the machine itself, i.e. the states and their transitions, from the code that compares sequences and determines what needs to be added to (or removed from) the machine to accommodate the variation.

24

Apr

2017

Improved route aggregation to include the AS set of all ASNs involved in the aggregation so that peers can better perform loop detection.

Improved community support so that imported communities are now in a useful format, and can also now be exported to peers. Added a new filter to match the commonly used no-export communities.

Improved handling of withdraw messages to deal with supernets of advertised prefixes being specified - we can't just remove the exact prefix sent by the peer. Also tidied up some other prefix matching that was using the overlaps() function rather than being a strict subset.

Tidied up AS path modification and community modification via filters to make copies of the route entries so that the changes are only temporary and not reused between different peers and VRFs. A clean original copy of the route is kept and modifications are applied to that rather than stacking up repeatedly on the same instance.

24

Apr

2017

Tidied up exporting routes to peers to remove some that should not be sent - routes should not be advertised back to the peer we got them from in the first place. Also started to filter routes by VRF as well, so that peers can be limited to which they receive routes from.

Started to build up a fake network topology based on the REANNZ network, with different peers and different relationships between them in order to make sure that the required capabilities are present to build a realistic network.

24

Apr

2017

Spent the week working on improving the ability to filter and modify routes as they arrive from a peer, are imported or exported to a VRF, or exported to other peers. Peers and VRFs now have a list of filters that are applied to incoming/outgoing routes. The filters contain lists of rules which are processed in order until one matches (based on prefix, peer, origin, etc), at which point the actions are applied to the rule to add/remove communities or to modify the AS path, and the route is accepted or rejected. If a filter fails to match then the next filter in the list is applied until eventually one matches or they all fail and the default behaviour occurs. Exported routes can now also be aggregated.

19

Apr

2017

Slightly disrupted week with Easter and cyclones having an impact on the productivity. Most of my time ended up being spent hunting down more previously unknown protocols. Just three new protocols this week, along with fixes for three more.

On the STRATUS side, I worked on creating a way to "combine" the suffix trees for each individual process so that we can account for sequences that appear frequently in the whole dataset but never more than once or twice within a given process. The original implementation would not recognise those sequences as frequent, because it considered each process individually. I think I've got this working now -- but I'm yet to look at the results too closely.

10

Apr

2017

Continued delving into the unknown traffic on the campus network. Had a mix of frustrating days and successful days -- one protocol (N2Ping) took nearly two days to track down but I got there in the end. 8 new protocols added to libprotoident this week again, so we're starting to get close to 400 supported protocols in libprotoident.

Another week of refinement on the FSM code. Most of the effort has been focused on loop recognition, particularly in terms of making sure we don't ignore candidates that can be used to identify loops.

06

Apr

2017

Put the finishing touches to the AMP throughput test before building some new packages for testing. Updated the collector packages to understand the new options so that the data can be accessed/saved.

Spent some time trying to integrate VRFs into the BGP project. Routes are currently placed into a number of VRFs based on the peer, and the VRFs that routes are exported from are selected based on the peer ASN and address.

Figured out an event in Chrome that I can easily hook into to determine when a Youtube video has ended (rather than polling and hoping), and wrote code to do so. I now have a standalone program that will tell me how much time was spent in initial buffering, later stalling/rebuffering, playback, etc. Started adding a timeline of actions to show how much time was spent in each state, and when. After that will likely be the task of trying to get this running as part of AMP (which could be annoying, at least until headless mode is available in packaged versions).

06

Apr

2017

Updated the AMP throughput test to allow masquerading as an HTTP POST, so that various middleboxes interested in HTTP traffic will take interest in our flow. This required tidying up the test protocol slightly and removing the last of the in-stream signalling so that there was space for the HTTP headers. As part of this I also improved the write handling so that the select timeout will trigger properly at the end of the test duration, lowering the chances of the last write dragging out the test duration.

Continued working on the BGP project, using ExaBGP to get access to nicely formatted BGP messages. Routes updates are accepted from and sent to peers, including our own local routes and routes learnt from other peers. Also updated the simple topology generator to allow updating links via the command line in real time to help testing.

03

Apr

2017

Have been using my new daily libprotoident email to make some good progress in terms of adding new protocols to libprotoident. Another 8 protocols added this week, with 5 existing protocols improved as well.

Found a few new bugs in my FSM tandem-repeat code after running it against my full test dataset and doing an initial validation of the resulting machines. Finished up a set of slides describing (broadly) what I'm doing overall with the FSM project and how I'm going about it, i.e. suffix trees, pattern extraction, variant detection and machine building.

Started looking into a parallel RT implementation for libtrace / wdcap, with an eye towards removing the combiner bottleneck from wdcap.

27

Mar

2017

Finished implementing tandem repeat detection within my existing pattern extraction code. The initial results look promising, i.e. the code has been able to identify "write,read" as a repeat in the FTP system call log with no obvious false positives. Next job will be to repeat the machine validation and make sure that I have improved the results overall.

Wrote a libprotoident program to perform daily monitoring of unknown payload patterns on the Waikato capture point and send me an email every morning with the 25 "biggest" patterns by payload, as well as a few example flows matching each pattern. Using this data, I've already been able to add a few new patterns to libprotoident and look forward to being able to be more proactive at keeping libprotoident up to date.