1. September 2008 - 1 RTC-Mon Enabling High-Speed and Extensible Real-Time Communications Monitoring Diego Costantini, Felipe Huici [costantini|huici]@nw.neclab.eu

2. September 2008 - 2 Motivation Internet as medium for real-time communications like VoIP has grown significantly over the past years However best-effort model not well-suited to these sort of applications Need real-time monitoring in order to –ensure good service quality –take corrective action should service degradation occur

3. September 2008 - 3 Monitoring Difficulties Real-time monitoring is difficult –System often has to correlate signaling and media streams –Connections tend to use dynamic ports –Monitoring in real-time results in non-trivial performance requirements  In the case of VoIP, the abundance of small packets exacerbates this problem

4. September 2008 - 4 State of the Art Current software solutions insufficient –Limited monitoring capabilities, not easy to extend –Long development time –Not efficient enough to track traffic in real-time Hardware solutions are inflexible and hard to extend Need a general monitoring framework that –provides basic VoIP monitoring capabilities in order to reduce development time –is easily extensible –is efficient enough to cope with demands of real-time traffic monitoring

5. September 2008 - 5 RTC-Mon: The Real-Time Communications Monitor Framework Implemented over Linux Consists of: Extended PF_RING with plugin architecture SIP and RTP plugins Event-based user-level library Also implemented VoIP Console Proof-of-concept monitoring application Small, quick to develop (800 lines of code) Can track numerous VoIP statistics extended PF_RING SIP plugin RTP plugin libpfring libvoip custom plugin VoIP console custom application network interfaces RTC-MON FRAMEWORK APPS USER SPACE KERNEL SPACE

6. September 2008 - 6 Extended PF_RING PF_RING –Linux kernel module providing new type of socket –Yields high performance –Can be used with any network card Extended PF_RING –Has plugin architecture –Includes IP defragmentation extended PF_RING SIP plugi n RTP plugi n libpfring libvoip custom plugin VoIP console custom application network interfaces RTC-MON FRAMEWORK APPS USER SPACE KERNEL SPACE

7. September 2008 - 7 Extended PF_RING Each PF_RING socket has set of rules –Processed sequentially Each rule has –a filter –a plugin ID to send packets to –an action ID which decides what to do after plugin processes packet Filter can be hash or wild-card based –Hash: can be used to track flows (RTP plugin) –Wildcard: more flexible (match all UDP packets to one port) extended PF_RING SIP plugi n RTP plugi n libpfring libvoip custom plugin VoIP console custom application network interfaces RTC-MON FRAMEWORK APPS USER SPACE KERNEL SPACE

8. September 2008 - 8 Libvoip User-level, event-based library Extensible, can support other, non-VoIP applications Made of a dispatcher and trackers –Dispatcher  receives packets from plugins and decides which trackers to send them to –Trackers  Combine information from several plugins to monitor a specific characteristic of the traffic  Can perform further analysis, parsing and can keep state  Library is extended by writing custom trackers extended PF_RING SIP plugi n RTP plugi n libpfring libvoip custom plugin VoIP console custom application network interfaces RTC-MON FRAMEWORK APPS USER SPACE KERNEL SPACE

9. September 2008 - 9 Libvoip Implemented two trackers –UserTracker, uses SIP information to keep track of SIP users –CallTracker, combines SIP/RTP data to monitor call information extended PF_RING SIP plugi n RTP plugi n libpfring libvoip custom plugin VoIP console custom application network interfaces RTC-MON FRAMEWORK APPS USER SPACE KERNEL SPACE

10. September 2008 - 10 VoIP Console Proof-of-concept monitoring application –Only 800 lines of code, short development time –Uses UserTracker, CallTracker and SIP/RTP plugins Despite small size, can still track large number of statistics extended PF_RING SIP plugi n RTP plugi n libpfring libvoip custom plugin VoIP console custom application network interfaces RTC-MON FRAMEWORK APPS USER SPACE KERNEL SPACE

11. September 2008 - 11 Evaluation: Testbed IXIA 400 generates up to 50,000 concurrent trash UDP flows VoIP traffic generator replays VoIP trace –Trace has 1,000 calls each lasting 30 seconds extended PF_RING SIP plugi n RTP plugi n libpfring libvoip custom plugin VoIP console custom application network interfaces RTC-MON FRAMEWORK APPS USER SPACE KERNEL SPACE Codec Sample Size (bytes) Sample Rate (ms) Max Num Flows (Gb link) G.711801011,468 G.72620518,116 G.72615521,186 G.72810531,780 G.72910 32,051 iLBC382036,101 G.723.1243045,732 G.723.1203048,077

12. September 2008 - 12 Performance Focus is on RTP traffic –puts larger strain on system than SIP Measure improvement in CPU usage from performing data analysis in kernel extended PF_RING SIP plugi n RTP plugi n libpfring libvoip custom plugin VoIP console custom application network interfaces RTC-MON FRAMEWORK APPS USER SPACE KERNEL SPACE

13. September 2008 - 13 Performance Measure monitoring performance for 50,000 flows and varying number of RTP rules (flows) extended PF_RING SIP plugi n RTP plugi n libpfring libvoip custom plugin VoIP console custom application network interfaces RTC-MON FRAMEWORK APPS USER SPACE KERNEL SPACE

14. September 2008 - 14 Performance Rule reconfiguration times extended PF_RING SIP plugi n RTP plugi n libpfring libvoip custom plugin VoIP console custom application network interfaces RTC-MON FRAMEWORK APPS USER SPACE KERNEL SPACE # RulesAvg. Ins. (usec) Max. Ins. (usec) Avg. Del. (usec) Max. Del. (usec) 10,00020.9984.781 20,00022.31305.395 30,00025.22107.9150 40,00027.937912.722.5 50,00047.1203719.152.7 In worst-case (2 msec) a single G.711 or G.729 packet would go untracked

15. September 2008 - 15 Conclusions Presented RTC-Mon –Framework for quickly developing real-time monitoring applications –Easily extensible, can support future applications –Performs well even under heavy loads and small packet sizes Future work –Additional plugins (RTSP, RTCP, MPEG-7?) –Distributed monitoring  Track SIP/RTP flows traversing different paths