Users' demands have dramatically increased due to widespread availability of broadband access and new Internet avenues for accessing, sharing and working with information. In response, operators have upgraded their infrastructures to survive in a market as mature as the current Internet. This has meant that most network processing tasks (e.g., routing, anomaly detection, monitoring) must deal with challenging rates, challenges traditionally accomplished by specialized hardware-e.g., FPGA. However, such approaches lack either flexibility or extensibility-or both. As an alternative, the research community has proposed the utilization of commodity hardware providing flexible and extensible cost-aware solutions, thus entailing lower operational and capital expenditure investments. In this scenario, we explain how the arrival of commodity packet engines has revolutionized the development of traffic processing tasks. Thanks to the optimization of both NIC drivers and standard network stacks and by exploiting concepts such as parallelism and memory affinity, impressive packet capture rates can be achieved in hardware valued at a few thousand dollars. This tutorial explains the foundation of this new paradigm, i.e., the knowledge required to capture packets at multi-Gb/s rates on commodity hardware. Furthermore, we thoroughly explain and empirically compare current proposals, and importantly explain how apply such proposals with a number of code examples. Finally, we review successful use cases of applications developed over these novel engines.

Virtualization and emulation have become worthy approaches to save significant amounts of money related to physical resource acquisition expenditures. In light of this, the development of network emulation platforms has led a revolution in the research and testing of novel services and applications, as they provide a cost-effective, flexible and reproducible environment for experimentation. However, they present some practical issues, in particular, their scalability is one of the limiting factors as it links the emulated networks that can be successfully deployed on a given hardware. We address this matter by testing the consumption and exploitation of physical resources of one popular network emulation platform, Mininet. We follow a methodology based on the isolation of the threads associated to the operating system, the virtual hosts, and the monitoring tasks. In such a manner, this approach can measure the effect of the placement of threads in the available cores, and help optimize bottlenecks that jeopardize the results of network emulations. Additionally, we monitor several key performance indicators for general-purpose Mininet deployments in different network topologies, varying the number of active elements, links and network conditions such as packet loss or delay. Our results show that Mininet presents performance bounds in commodity servers that suffice a wide range of general network tests. It achieves aggregated bandwidths above 10 Gb/s and median round-trip time values around 1 ms, even in demanding scenarios where more than a thousand hosts, up to 64-hop paths and 64 subnets are included in the emulated topologies.

In network management, it is important to model baselines, trends, and regular behaviors to adequately deliver network services. However, their characterization is complex, so network operation and system alarming become a challenge. Several problems exist: Gaussian assumptions cannot be made, time series have different trends, and it is difficult to reduce their dimensionality. To overcome this situation, we propose Deep-FDA, a novel approach for network service modeling that combines functional data analysis (FDA) and neural networks. Specifically, we explore the use of functional clustering and functional depth measurements to characterize network services with time series generated from enriched flow records, showing how this method can detect different separated trends. Moreover, we augment this statistical approach with the use of autoencoder neural networks, improving the classification results. To evaluate and check the applicability of our proposal, we performed experiments with synthetic and real-world data, where we show graphically and numerically the performance of our method compared to other state-of-the-art alternatives. We also exemplify its application in different network management use cases. The results show that FDA and neural networks are complementary, as they can help each other to improve the drawbacks that both analysis methods have when are applied separately.

Novel packet I/O engines allow capturing traffic at multi-10Gb/s using only-software and commodity-hardware systems. This is achieved thanks to the application of techniques such as batch processing. Nevertheless, this feature involves degradation in the timestamp accuracy, which may be relevant for monitoring purposes. We propose two different approaches to mitigate such effect: a simple algorithm to distribute inter-batch time among the packets composing a batch, and a driver modification to poll NIC buffers avoiding batch processing. Experimental results, using both synthetic and real traffic, show that our proposals allow capturing accurately timestamped traffic for monitoring purposes at multi-10Gb/s rates.