1. User-driven Networking in IaaS Clouds Daniel Kouril, Tomas Rebok, Michal Prochazka Masaryk University/CESNET EGI-Geant Symposium, 27th September 2014

2. Requirements for Advanced Networking Addressing schemas ipv4, ipv6, non-ip protocols Simulation of various communication technologies (GPRS, ADSL, Wifi) Detailed monitoring of individual connections between individual nodes Controlled completely by user with no/minimal involvement of cloud admins Traffic contained within a sandbox

3. Solution ISO L2 control needed to fulfill requirements Ethernet-like arrangement ISO L2 networking: Point-to-point links between two nodes Interconnections of links (frame switching) Overlay L2 network on the top of cloud Pseudo-wires Virtualized switch

5. LAN Management Node (switch) Standard Linux VM Multiple network interfaces Network monitoring enabled Auxiliary services deployed

6. Current implementation Pseudo-wires implemented using VLANs Traffic cannot leak LAN Management Node Openvswitch used as software switch Piloted in OpenNebula environment Network configuration updated Network templates L2, L3 filtering disabled on interfaces Netem/tc used to set network parameters API developed to instatiate the links, host, parameters, …

7. Current limitations LANs limited to a single hardware host Basic cloud setup needed at the beginning

8. Cyber Proving Ground Environment for Security Research and Training Sandboxed environment for forensics, trainings, gaming Realistic networking Network containment Network-level monitoring of single links Netflows, DPI

9. Sandbox example

10. User-driven Networking in IaaS Clouds ? Daniel Kouril, Tomas Rebok, Michal Prochazka http://www.muni.cz/ics/kypo https://twitter.com/csirtmu