@FlowInspector, the traffic monitoring system with a built-in hardware accelerator compatible with virtualizationNTT Device Innovation Center

The operation using the packet analysis and virtualization technology on systems in virtualization environments has been gathering attention. The traffic monitoring system we have developed uses the hardware (HW) technology for packet processing and the software (SW) for virtualization technology in processing the packets that have complicated structures on virtualization network so as to realize the real-time visualization on each system for the traffic in virtualization environments.

The system constructions on virtual servers and networks are spreading for the efficiency in using resources. On those virtual systems, servers, network devices, and/or other physical resources are shared; therefore, it has been difficult to isolate systems for identifying the cause of a trouble, which has been one of the problems in such operation.

• Mirrored traffics are monitored to visualize the statuses of the traffics and virtual machines on each virtual system without any influence over main signal systems.
• The complicated capsuling packets used for virtualization is analyzed in real-time with the HW technology by using FPGA so as to generate the statistical information necessary for the system operation and to realize the visualization of the operation status and the detection of problems.
• The smart packet captures before and after the occurrence of a problem triggered by the detection of a micro-burst or the like.
• The Field Programmable Gate Array (FPGA) and general-purpose servers are used to realize the monitoring appliance and thus to realize the system monitoring more economic than dedicated devices.

• High reliability services that accommodate multiple users in a virtualized environment which need to detect problems on each user in real time

One of the features of this technology is the use of the open source software to combine high-level functions and high-performance processing based on hardware and thus to realize the traffic monitoring compatible with a variety of traffic environments. Conventionally, the packets were captured and analyzed once a problem occurred to handle the problems in operation as the operational solution compatible with virtualization environments. Those forms of operation involved problems; namely, the time-lag taken for the analyses of captured data and the lack of the experts with such skills. This technology has employed the packet processing technology by using the hardware owned by NTT Device Innovation Center to realize the flexible packet monitoring processing with the protocols up to Layer 4 combined freely and thus the acquisition of the real-time statistical information at the full-wire rate of 10 Gbit/s of the monitored packets. The statistical information is visualized by the open resource software so that the traffic suffering from a problem is easily identified, and thus highly reliable service operation is realized. This technology is productized with a FPGA board and the device appliance comprising a 1U-rack server to have it installed; the functions are available when the mirrored packets are input for the purpose of converging networks. We are planning to enrich the statistical information functions involving TCP session counts and so forth and to add the protocols in consideration to carriers' networks so that the monitoring appliance for a wide scope of use scenes can be applied in the future.

NTT Device Innovation Center - Metro-Access Network Device Project