Skip to content

Commit

Permalink
Merge branch 'development'
Browse files Browse the repository at this point in the history
  • Loading branch information
@josemariasaldana
josemariasaldana committed Jun 13, 2017
2 parents d115234 + 7a29df2 commit 62f334b
Show file tree
Hide file tree
Showing 4 changed files with 282 additions and 80 deletions.
103 changes: 97 additions & 6 deletions README.md
View file
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
odin-wi5-flow-detection
=======================

The objective of this tool is to integrate detection of flows within the Odin framework. The idea is to identify flows belonging to different services, and to report this to the Odin controller. This information will be taken into account when running the different radio resource management algorithms. For example, if a real-time flow has been detected, then the Controller should act in order to grant the delay constraints required by that service.
The objective of this tool is to integrate detection of flows within the Odin wi5 framework. The idea is to identify flows belonging to different services, and to report this to the wi5 Controller. This information will be taken into account when running the different radio resource management algorithms. For example, if a real-time flow has been detected, then the Controller should act in order to grant the delay constraints required by that service.

The detection tool is based on Click modular router. See https://github.com/kohler/click.git

Expand Down Expand Up @@ -73,12 +73,12 @@ Compile the detector
- Copy the two files `detection_agent.cc` and `detection_agent.hh` to `click/elements/local`

- Compile Click with these options
`~$ ./configure --prefix=/home/proyecto --enable-local --enable-userlevel`
`~click$ ./configure --prefix=/home/proyecto --enable-local --enable-userlevel`

- Build the element list
`~$ make elemlist`
`~click$ make elemlist`

- Run `~$ make`
- Run `~click$ make`

You will then have a Click in `click/userlevel/click` including the detection agent.

Expand All @@ -88,15 +88,106 @@ Run the detector

Create the `.click` file with the Python script. One example:

~$ python detection_agent-click-file-gen.py 192.168.T.Z 2819 192.168.X.Y 2 12 > ../detection.click
~$ python detection_agent-click-file-gen.py 192.168.T.Z 2819 192.168.X.Y 2 12 > ../detection.cli

And run Click

~$ ./click/userlevel/click detection.click
~$ ./click/userlevel/click detection.cli

Duplicate the traffic to be analyzed and direct it to the network interface of the detection machine
----------------------------------------------------------------------------------------------------

You can use the `-j TEE` option of `iptables` to duplicate the traffic. This is an example that works in a kernel 3 (but not in a kernel 2.6). Traffic from `192.168.200.3` will be duplicated and sent to 192.168.0.4 (in addition to its normal destination).

~$ iptables -t mangle -A PREROUTING -s 192.168.200.3 -j TEE --gateway 192.168.0.4

Information caputred by the detection agent
-------------------------------------------

This is the payload of the messages sent from the agent to the wi-5 controller. It includes the word 'Flow', plus a 5-tuple with the IP addresses, the protocol field and the source and destination ports:

```
Flow 192.168.101.2 192.168.101.3 . 37699 3000
Flow 192.168.101.2 192.168.101.3 . 44170 3000
Flow 192.168.101.2 192.168.101.3 . 52483 3000
Flow 192.168.101.2 192.168.101.3 . 37699 3000
Flow 192.168.101.2 192.168.101.3 . 36399 3000
```
**Note**. In this case, the value of the `protocol` field cannot be observed, and it is shown as a dot. The cause is that it corresponds to UDP, number 17 decimal and 11 hexadecimal, which has no representation in ASCII.


Real-time information is shown by the screen every time a new flow message is sent to the wi-5 controller:

```
[DetectionAgent.cc] flow message sent: Flow 192.168.101.2 192.168.101.3 49001 3000
[DetectionAgent.cc] flow message sent: Flow 192.168.101.2 192.168.101.3 39199 3000
[DetectionAgent.cc] flow message sent: Flow 192.168.101.2 192.168.101.3 49001 3000
```

Periodic reports are also generated by the screen for debugging purposes. This is an example of a periodic report including the information of 4 different flows:

```
##################################################################
[DetectionAgent.cc] ##### Periodic report. Number of flows: 4
[DetectionAgent.cc]Flow: 1
[DetectionAgent.cc] -> Source IP: 192.168.101.2
[DetectionAgent.cc] -> Destination IP: 192.168.101.3
[DetectionAgent.cc] -> Protocol: 17
[DetectionAgent.cc] -> Source Port: 55992
[DetectionAgent.cc] -> Destination Port: 3000
[DetectionAgent.cc] -> last sent: 1479224716.755008897 sec
[DetectionAgent.cc] -> last heard: 1479224707.696236085 sec
[DetectionAgent.cc]Flow: 2
[DetectionAgent.cc] -> Source IP: 192.168.101.2
[DetectionAgent.cc] -> Destination IP: 192.168.101.3
[DetectionAgent.cc] -> Protocol: 17
[DetectionAgent.cc] -> Source Port: 51794
[DetectionAgent.cc] -> Destination Port: 3000
[DetectionAgent.cc] -> last sent: 1479224716.195016870 sec
[DetectionAgent.cc] -> last heard: 1479224710.160633586 sec
[DetectionAgent.cc]Flow: 3
[DetectionAgent.cc] -> Source IP: 192.168.101.2
[DetectionAgent.cc] -> Destination IP: 192.168.101.3
[DetectionAgent.cc] -> Protocol: 17
[DetectionAgent.cc] -> Source Port: 41530
[DetectionAgent.cc] -> Destination Port: 3000
[DetectionAgent.cc] -> last sent: 1479224716.675013732 sec
[DetectionAgent.cc] -> last heard: 1479224712.656139175 sec
[DetectionAgent.cc]Flow: 4
[DetectionAgent.cc] -> Source IP: 192.168.101.2
[DetectionAgent.cc] -> Destination IP: 192.168.101.3
[DetectionAgent.cc] -> Protocol: 17
[DetectionAgent.cc] -> Source Port: 41333
[DetectionAgent.cc] -> Destination Port: 3000
[DetectionAgent.cc] -> last sent: 1479224716.365020750 sec
[DetectionAgent.cc] -> last heard: 1479224715.360148596 sec
##################################################################
```

Information shown in the wi-5 odin controller
---------------------------------------------

This is the log information you will see in the controller:
```
17:24:55.899 [pool-3-thread-8] INFO n.f.odin.master.OdinMaster - We receive a detected flow 192.168.2.130 192.168.2.131 17 58463 32000 registered as Id: 1 from: 192.168.1.200
17:24:55.899 [pool-3-thread-8] INFO n.f.o.a.FlowDetectionManager - [FlowDetectionManager] Detected flow
17:24:55.899 [pool-3-thread-8] INFO n.f.o.a.FlowDetectionManager - [FlowDetectionManager] -> Source IP: 192.168.2.130
17:24:55.899 [pool-3-thread-8] INFO n.f.o.a.FlowDetectionManager - [FlowDetectionManager] -> Destination IP: 192.168.2.131
17:24:55.899 [pool-3-thread-8] INFO n.f.o.a.FlowDetectionManager - [FlowDetectionManager] -> Protocol IP: 17
17:24:55.899 [pool-3-thread-8] INFO n.f.o.a.FlowDetectionManager - [FlowDetectionManager] -> Source Port: 58463
17:24:55.900 [pool-3-thread-8] INFO n.f.o.a.FlowDetectionManager - [FlowDetectionManager] -> Destination Port: 32000
17:24:55.900 [pool-3-thread-8] INFO n.f.o.a.FlowDetectionManager - [FlowDetectionManager] from agent: /192.168.1.200 at 1497367495900
17:24:55.900 [pool-3-thread-8] INFO n.f.o.a.FlowDetectionManager -
17:24:55.900 [pool-3-thread-8] INFO n.f.o.a.FlowDetectionManager -
17:24:56.200 [pool-3-thread-10] INFO n.f.odin.master.OdinMaster - We receive a detected flow 192.168.2.130 192.168.2.131 17 51408 32000 registered as Id: 1 from: 192.168.1.200
17:24:56.200 [pool-3-thread-10] INFO n.f.o.a.FlowDetectionManager - [FlowDetectionManager] Detected flow
17:24:56.200 [pool-3-thread-10] INFO n.f.o.a.FlowDetectionManager - [FlowDetectionManager] -> Source IP: 192.168.2.130
17:24:56.200 [pool-3-thread-10] INFO n.f.o.a.FlowDetectionManager - [FlowDetectionManager] -> Destination IP: 192.168.2.131
17:24:56.200 [pool-3-thread-10] INFO n.f.o.a.FlowDetectionManager - [FlowDetectionManager] -> Protocol IP: 17
17:24:56.200 [pool-3-thread-10] INFO n.f.o.a.FlowDetectionManager - [FlowDetectionManager] -> Source Port: 51408
17:24:56.200 [pool-3-thread-10] INFO n.f.o.a.FlowDetectionManager - [FlowDetectionManager] -> Destination Port: 32000
17:24:56.201 [pool-3-thread-10] INFO n.f.o.a.FlowDetectionManager - [FlowDetectionManager] from agent: /192.168.1.200 at 1497367496201
17:24:56.201 [pool-3-thread-10] INFO n.f.o.a.FlowDetectionManager -
17:24:56.201 [pool-3-thread-10] INFO n.f.o.a.FlowDetectionManager -
```
Loading

0 comments on commit 62f334b

Please sign in to comment.