This master's thesis describes the design and implementation of system for processing application protocols in high-speed networks using the concept of Software Defined Monitoring. The proposed solution benefits from hardware accelerated network card performing pre-processing of network traffic based on the feedback from monitoring applications. The proposed system performs pre-processing and filtering of network traffic which is handed afterwards passed to application modules. Application modules process application protocols and generate metadata that describe network traffic. Pre-processing consists of parsing of network protocols up to the transport layer, TCP reassembling and forwarding packet flow only to modules that are looking for a given network traffic. The proposed system closely links intercept related information internal interception function (IRI-IIF) and content of communication internal interception function (CC-IIF) to minimize the performing of duplicate operations and increase the efficiency of the system.

This master's thesis deals with the design of software controlled hardware acceleration system for high-speed networks. The main goal is to provide easy access to acceleration for various network security and monitoring applications. The proposed system is designed for 100 Gbps networks. It enables high-speed processing on an FPGA card together with flexible software control. The combination of hardware speed and software flexibility allows easy creation of complex high-performance network applications.  Achievable performance improvement of three chosen monitoring and security applications is shown using simulation model of the designed system.

This master's thesis deals with the design and implementation of an algorithm for high-speed network packet filtering. The main goal was to provide hardware architecture, which would support large rule sets and could be used in 100 Gbps networks. The system has been designed with respect to the implementation on an FPGA card and time-space complexity trade-off. Properties of the system have been evaluated using various available rule sets. Due to the highly optimized and deep pipelined architecture it was possible to reach high working frequency (above 220 MHz) together with considerable memory reduction (on average about 72% for compared algorithms). It is also possible to efficiently store up to five thousands of filtering rules on an FPGA with only 8% of on-chip memory utilization. The architecture allows high-speed network packet filtering at wire-speed of 100 Gbps.

Tato disertační práce se zabývá návrhem nového způsobu softwarově řízené (definované) hardwarové akcelerace pro moderní vysokorychlostní počítačové sítě. Hlavním cílem práce je formulace obecného, flexibilního a jednoduše použitelného konceptu akcelerace použitelného pro různé bezpečnostní a monitorovací aplikace, který by umožnil jejich reálné nasazení ve 100 Gb/s a rychlejších sítích. Disertační práce začíná rozborem aktuálního stavu poznání v oborech síťového monitorování, bezpečnosti a způsobů akcelerace zpracování vysokorychlostních síťových dat. Na základě tohoto rozboru je formulován a navržen zcela nový koncept s názvem Softwarově definované monitorování (SDM). Klíčová funkcionalita uvedeného konceptu je postavená na hardwarově akcelerované, aplikačně specifické (řízené), na tocích založené, informované redukci a distribuci zachycených síťových dat. Toto je zajištěno spojením vysokorychlostního hardwarového zpracování s flexibilním softwarovým řízením, které tak společně umožňují jednoduchou tvorbu různých komplexních a vysoce výkonných síťových aplikací. Pokročilé optimalizace a vylepšení základního SDM konceptu a jeho vybraných komponent jsou v práci též zkoumány, což vede k návrhu zcela unikátní a obecně použitelné FPGA architektury modulárního analyzátoru hlaviček paketů a vysoce výkonného klasifikátoru paketů založeného na kukaččím hashovaní. Nakonec je vytvořen vysokorychlostní SDM prototyp postavený nad FPGA akcelerační síťovou kartou, který je podrobně ověřen v podmínkách nasazení do reálných sítí. Jsou změřeny a diskutovány dosažitelné zlepšení výkonností v několika vybraných monitorovacích a bezpečnostních případech užití. Vytvořený SDM prototyp je rovněž nasazen v produkčním monitorování reálné páteřní sítě sdružení Cesnet a byl komercializován společností Netcope Technologies.

[pt] A difusão seletiva e os recentes avanços na tecnologia de transmissão óptica, mais especificamente na multiplexação por comprimento de onda (Wavelength Division Multiplexing- WDM), aliados à consolidação do IP como protocolo dominante das redes convergentes, vêm oferecendo novas perspectivas para as futuras gerações de inter-redes. Este trabalho faz uso da evolução dessas tecnologias para propor um conjunto de adaptações à difusão seletiva, em especial ao IP Multicast, denominado MIRROR (Multicast IP para Redes baseadas em Rajadas Ópticas Rotuladas). A proposta MIRROR sugere modificações e adequações para tornar o IP Multicast menos complexo, mais escalável em relação ao número de grupos ativos simultaneamente e mais adequado às redes baseadas em comutação óptica. Basicamente, MIRROR revê a necessidade de todos os roteadores ao longo da árvore de distribuição multiponto manterem informações de estado relacionadas a esta, bem como sugere adequações na forma como os caminhos multiponto são estabelecidos quando se emprega comutação baseada em rótulos na difusão seletiva. Para avaliar a proposta MIRROR, investiu-se em duas frentes distintas, uma baseada na análise comparativa entre a MIRROR e algumas alternativas ao IP Multicast apresentadas na literatura, e outra baseada no desenvolvimento de um protótipo da proposta no simulador NS (Network Simulator), com o intuito de referendar os resultados da análise comparativa. Na análise comparativa, confronta-se parâmetros como: requisitos de informações de estado, custo com informações de controle, custo de encaminhamento dos pacotes e custo da árvore de multiponto. O desenvolvimento do protótipo envolveu a criação de uma nova estrutura de nó e a alteração de módulos já existentes no NS, para tornar possível a simulação de redes comutadas por rajadas ópticas rotuladas no contexto da difusão seletiva. / [en] Multicast communication and recent advances in optical technology, most specifically in Wavelength Division Multiplexing (WDM), allied with the consolidation of IP as the dominant protocol of convergent networks, offer new perspectives for the next generation Internet. This thesis utilises these technologies to propose a set of adaptations, called MIRROR, to multicast communication, specifically IP Multicast, in labelled burst-switched optical networks. MIRROR proposes modifications to traditional IP Multicast in order to improve its scalability as a function of the number of simultaneously active groups, as well as making it more appropriate for use in optically switched networks. Basically, MIRROR includes new proposals for handling state information about the multicast distribution tree, as well as for the establishment of label-based multicast paths. In order to evaluate this proposal, two approaches are followed, one based on a comparative analysis between MIRROR and a number of other alternatives to IP Multicast proposed in the literature, and the other based on the implementation of a prototype in the simulation environment provided by NS (Network Simulator). The comparative analysis evaluates such parameters as: state requirement information, control overhead, packet processing efficiency and tree cost. The prototype implementation implements a new node structure and alters existing NS modules (OBS e MPLS), to make possible the simulation of labelled burst-switched optical networks in the multicast context.

This master's thesis is focused on extension of the DPDK DNS Probe application that monitors DNS traffic in high speed networks. It presents framework DPDK, which can be used for fast packet processing. General architecture of the DNS system is described as well as details of its components. Basic principles of transport protocol TCP are described. It introduces an effective design and implementation of DNS packet parsing to optimize DPDK DNS Probe's performance. It also introduces a design and implementation of processing DNS messages sent over TCP for export of traffic statistics. The application's performance was tested using a high speed traffic generator Spirent.

This thesis describes the development of a networking device used to defend against (D)DoS attacks using P4 language. The main purpose was to design flexible device using P4 lan-guage based on already existing device, this would allow us to quickly react and respond to new more complex DDoS attacks. The design of the device dealt with the transfer of individual parts of the firmware into the P4 language. Subsequently, the entire device firmware was designed for hardware accelerators with FPGA technology. The firmware had been designed with respect to the limitations of current P4 language compilers. The device has been tested under laboratory conditions for functionality and performance. The device will be deployed in the network infrastructure of CESNET.

This Master’s thesis analizes technologies suitable for metropolitan area networks. In this thesis there are mentioned technologies used for wireless transfer with speeds above 1 Gbps. There are described basic features and parameters of microwave radio relay links in 70/80GHz range and free space optic links. These technologies are compared with classic optical networks. Practical part of thesis was focused on development of application which calculates signal attenuation caused by the passage of the atmosphere for both technologies. Results gained from this application are mentioned in this Master’s thesis.