Passively monitoring networks at gigabit speeds using commodity hardware and open source so.pdfVIP

Passively Monitoring Networks at Gigabit Speeds Using Commodity Hardware and Open Source Software Luca Deri, NETikos S.p.A. not only in terms of volume but also in terms of type, as Abstract—Passive network monitoring is a complex these applications redefined the concept of client and server. activity that mainly consists in packet capturing and Usually a server is a host that provides a service to several classification. Unfortunately this architecture often cannot clients. In terms of IP traffic: be applied to gigabit networks, as the amount of data to • A client establishes one or more connections with a capture is too large for the monitoring applications. server, uses the server, and then closes the connections. This paper describes the challenges and lessons learnt by the author while monitoring networks at gigabit speeds and • Servers can exchange data with both clients and above. Finally, it describes an architecture able to servers, whereas clients talk only with servers. successfully monitor networks at high speeds using • Client to server connections are often asymmetrical commodity hardware and open source software. (e.g. in HTTP the client sends little data with respect to the server). Index Terms—Passive Network Monitoring,