穩定網路流量重播至應用層代理伺服器

Stateful Traffic Replay on Application Proxies

廖鵬宇(Peng-Yu Liao)

指導教授 ： 林盈達

國立交通大學/資訊學院/網路工程研究所/碩士(2010年)

https://doi.org/10.6842/NCTU.2010.00414

摘要

重播流量到網路產品並觀察它們的反應是一種測試網路產品的方法。目前已存在的重播工具大多提供傳輸層的流量重播，以測試交換器、路由器、閘道器等產品。然而，現有的流量重播工具無法針對應用層代理伺服器網路產品進行重播。有鑑於此，基於應用層代理伺服器具有建立連線與修改應用層訊息的特性，我們在本論文設計並實作一個適用於應用層通訊協定的ProxyReplay重播工具。代理伺服器常常具有一些網路流量處理功能，如內容快取與過濾。這些行為可能會改變重播應用層流量的基本流程，導致當內容快取與過濾行為發生時，重播工具送出不必要的訊息，或是訊息無法被正常處理。ProxyReplay這個工具按照應用層協定規範的流程準確重播流量至應用層代理伺服器，它可以根據不同網路功能進行處理，如更新訊息標頭檔讓訊息正確快取，檢查要求訊息再重播對應的回應訊息，防止內容過濾發生時送出不必要的訊息。最後，為了避免重播時所帶來記憶體空間的限制，ProxyReplay也提供同步重播的機制，以處理比實際記憶體空間還要大的流量資料，在實驗結果中，ProxyReplay可達到200Mbps以上的輸出效能，並重播大於實際記憶體空間的真實流量。

關鍵字

流量重播 ； 流量錄製 ； 真實流量 ； 應用層代理伺服器

並列摘要

It is common to test network devices by replaying network traffic to them and observe their reactions. Most existing replay tools support layer 4 stateful traffic replay and hence they can be used to test switch, router, and gateway devices. However, they do not support stateful traffic replay to application level proxies. Therefore, considering the characteristics of connection interception and content modification, we design and implement the ProxyReplay tool for application layer proxies in this thesis. Application proxies often provide features such as data-caching and content filtering. These features may affect replay procedures. As a result, it is possible that a replay tool replays invalid application messages that cannot be correctly processed by proxies. The proposed tool not only supports stateful replay to application proxy by following the protocol procedure, it also handles different proxy behaviors. For instance, it updates message headers so that web-caching works correctly and it also analysis messages received from a proxy to prevent from replaying of invalid responses when content filtering is adopted. Although replayed data is usually preprocessed and stored in memory during a replay process, the ProxyReplay tool provides a concurrent replay mode which allows it to replay network traces that are much greater than the physical memory. In the experiment, the throughput of ProxyReplay can achieve 200Mbps but also replays the real flow trace file which is larger than the physical memory.

並列關鍵字

traffic replay ； traffic capture ； real flows ； application proxy

參考文獻

[1] A. Turner, Tcpreplay, http://tcpreplay.synfin.net/trac/.

[7] Weidong Cui, Vern Paxson, Nick C. Weaver, and Randy H. Katz., “Protocol-Independent Adaptive Replay of Application Dialog,” in Proceedings of the 13th Annual Network and Distributed System Security Symposium (NDSS), February 2006.

[9] Guillaume Pierre and Mesaac Makpangou, “Saperlipopette!: a distributed Web caching systems evaluation tool,” Proceedings of the Middleware conference, 2009.

[10] Ari Luotonen, “Web Proxy Servers”, Netscape Communications Corporation, 1997.

[13] Fabian Schneider, Jorg Wallerich, Anja Feldmann, “Packet Capture in 10-Gigabit Ethernet Environments Using Contemporary Commodity Hardware,” Passive and Active Measurement Conference, April 2007.