1. 6MoN plus geographically distributed dual stack network monitoring #TNC16 | #IIT-CNR | #6MoN Speaker: Abraham Gebrehiwot

2. Present-day Internet architecture #TNC16 | #IIT-CNR | #6MoN 6MoN plus IPv6 6to4 router 6to4 relay

3. Dual-stack (IPv4/IPv6) networks monitoring #TNC16 | #IIT-CNR | #6MoN ★ Oftentimes, maybe unknown to us, IPv6 is already up and running on our devices. ★ We need a tool to simplify the management and monitoring of dual- stack networks, having three fixed goals: ○understand the networks and hosts behavior; ○resolve any network anomalies; ○monitor the IPv4/IPv6 address utilization. 6MoN plus

4. Geo-distributed network monitoring #TNC16 | #IIT-CNR | #6MoN ★ Managing and monitoring geo-distributed network is not a simple task: ○we need to be physically connected to the remote network in order to gather some traffic; ○present-day Internet architecture does not help: ■Firewalls and NATs might be found! ★ We need to have a distributed monitoring tool accessible from a unique GUI. 6MoN plus

5. 6MoN plus - what does it offer? #TNC16 | #IIT-CNR | #6MoN ★ it detects, mitigates and notifies rogue IPv6 Router Advertisments; ★ it allows to monitor network addresses utilization by finding associations between IPv4, IPv6, MAC addresses, DUIDs, Usernames, etc. within a period of time; ★ it inspects routers' IPv6 neighbor caches leveraging SNMP protocol; ★ it detects and notifies the presence of rogue DHCPv4 servers. ★ L2 loop detection ★ IPv4 address collision ★ MacFind ★ remote controling of the probes and the installed modules ★ NAT and Firewall traversal ★ previleged based multi user management ★ efficient and better algorithms 6MoN plus

6. 6MoN plus - comparison with other solutions #TNC16 | #IIT-CNR | #6MoN ★ Rogue router advertisment mitigation ○RA-guard: L2 filtering of rogue router advertisment ○SEcure Neighbor Discovery (SEND): Cryptographic method ○Host based packet filtering ○6MoN: previously developed by our team ○NDPMon - dual stack network monitoring tool (remote monitoring modules are not stable for production use) ★ DHCP Monitoring: L2 filtering 6MoN plus

7. 6MoN plus - development team Filippo Lauria Claudio PortaAndrea De Vita 6MoN plus Abraham Gebrehiwot #TNC16 | #IIT-CNR | #6MoN

8. 6MoN plus - system architecture #TNC16 | #IIT-CNR | #6MoN Probe 1Probe 2Probe N Core GUI DB hybrid architecture: back-end front-end distributed back-end: N Probes A central Core multi-tier front-end. 6MoN plus

9. 6MoN plus - backend behavior #TNC16 | #IIT-CNR | #6MoN Probe: a remote application able to gather and extract relevant information from the network traffic; Core: process able to collect and manage data incoming from the probes; Probe 1Probe 2Probe N Core DB Features: NAT and Firewall Traversal Communication: control plane, data plane 6MoN plus

10. 6MoN plus - front end behavior #TNC16 | #IIT-CNR | #6MoN Probe 1Probe 2Probe N Core GUI DB Probe: a remote application able to gather and extract relevant information from the network traffic; Core: process able to collect and manage data incoming from the probes; GUI: to easily allow access, configuration and control of the system. 6MoN plus

11. 6MoN plus - backend gathering information #TNC16 | #IIT-CNR | #6MoN 6MoN plus ★ In order to synthesize the information a probe performs few simple tasks: ○select only the relevant pieces of information ■e.g. from an ARP packet we need to know only SW_ADDR (IP Address) and HW_ADDR (MAC Address) fields ○reduce transmission of information (to the core), using a caching system

12. Caching System 6MoN plus - probe’s caching system #TNC16 | #IIT-CNR | #6MoN 6MoN plus ★ Threshold-based caching system (simplified version): ○Time-based (default: 30 seconds) ○Based on number of processed packets (default: 30 packets) ARP Processing Unit hit miss send to core thresholds expired erase entry update counting threshold don’t send Packet Sniffer insert new entry

13. 6MoN plus - use case #TNC16 | #IIT-CNR | #6MoN 6MoN plus

14. 6MoN plus - strengths #TNC16 | #IIT-CNR | #6MoN 6MoN plus Modularity Scalability Efficiency Easy setup Low installation and managing costs

15. 6MoN plus - development #TNC16 | #IIT-CNR | #6MoN 6MoN plus ●Probe ○it can execute on a Raspberry Pi, too! ●Core ○it can be installed on a VM, too! ●Open Source ○no additional licence costs ○source code available

16. 6MoN plus - future work #TNC16 | #IIT-CNR | #6MoN 6MoN plus ★ extend 6MoN Plus’ functionalities: ○IoT applications (e.g. devices, vehicles, buildings, etc.); ○Smart Cities applications (e.g. traffic monitor, air quality monitor, etc.).

17. Thank you for your attention For further details: abraham.gebrehiwot@iit.cnr.it 6MoN plus