Peter Sanders, VP Field Applications Engineering at Napatech, looks at the importance of zero packet loss to a successful IDS deployment - measured by its effects on intrusion alert generation and file extraction.
The data growth challenge
As network traffic increases, there is a need for high-speed networks to ensure service level and capacity. In telecom networks and data centers, serving hundreds of thousands of users, 100 Gbps network links are deployed to keep up with the growing demand. Consequently, there is a need for testing and troubleshooting on the networks at 100G link speed.
Benefits of network traffic replay
Today, as there are so many services and subscribers depending on stable data network, quality and maturity is critical when deploying new solutions. Testing new network solutions or new versions of networking products or applications is a challenge because synthetic test cases do not disclose all potential issues. Replaying real production network traffic provides more realistic test scenarios. Moreover, the test coverage can be extended by replaying traffic from many different networks.
In case of network issues, efficient troubleshooting reduces the disruptions and potential down-time of services. Network traffic replay provides a powerful tool for reproducing and analyzing issues in a lab environment, not affecting the production network. Identification of network issues requires precise replay, throughput-wise and timing-wise. For example, traffic micro-burst can only be recreated in a lab environment if the solution supports full throughput and precise timing of packets replayed.
What are the options?
There are complete solutions for capture & replay of 100G network traffic in the market today. In some cases, these products match the actual need, but in other cases the solutions are way too expensive, have too many features or cannot be customized to special use cases.
An alternative approach is to build your own replay solution, using a COTS server, a standard Linux OS and a 100G SmartNIC. The COTS server has all the horsepower and I/O performance needed to run 100G replay. Linux OS enables use of open source software or easy application development and feature customization. The SmartNIC ensures full throughput transmit for any packet size, with precise transmit timing, with some FPGA SmartNICs having 1 nanosecond time resolution.
Build your own 100G replay solution with COTS server
A well performing 100G replay solution requires certain qualities from the building blocks.
To obtain maximum replay performance, it is recommended to have maximum memory bandwidth available in the server. The server should be populated with the maximum number of DDR4 memory blocks, to allow full use of all the memory channels. Another recommendation is to use dual rank DDR4 or higher memory blocks running at least 2133 MHz. To replay large files, the packet store output performance limits the maximum average replay speed. Fast Solid State Disk should be considered for high speed replay.
The SmartNIC must support a 100G network interface with line-rate capture and transmit for any packet size, high precision time stamping of received traffic, high precision transmit timing, efficient buffer system and optimized DMA scheme over the PCIe interface.
Open source capture & replay applications are available and some SmartNIC vendors include tools for capture and replay in their software suite. The application should utilize server memory for buffering traffic from packet store before transmission. This is to compensate for the difference between 100G peak network packet rate and maximum read rate from the packet store.
The replay solution in practice
In a simple scenario, traffic is captured at a single point in the network and replayed via a single output port in the lab environment.
In other cases, it is necessary to capture and replay traffic from multiple points in the network. For true simulation of the multipoint traffic scenario, capture must be synchronized across all the capture applications and replay must be synchronized across all the replay applications. Synchronization can be supported through an IEEE1588 PTP enabled network, and highest accuracy synchronization is achieved when FPGA SmartNICs support PTP in hardware.
If you need a flexible, fully customizable network traffic replay solution, I would recommend a COTS server solution and look for Smart NICs supporting full throughput transmit at 100G. Be sure to pay special attention to make sure that transmit also has time precision.