14 SCAMPI

14.1 Introduction

SCAMPI (Scaleable Monitoring Platform for the Internet) is an IST family project supported by the European Commission (IST-32404). CESNET is one of the principal contractors participating in the project since the proposal preparation in the beginning of 2001. The project has started on April 1, 2002; its total duration is 30 months. 2003 represented the most important year in the SCAMPI project.

The project goal is design and development of high-speed (i.e., up to 10 Gbps) network traffic monitoring architecture. The highest layer of this architecture are applications (e.g., QoS monitoring, SLS auditing, DoS detection, accounting). The middle layer is a universal MAPI (Monitoring API) which represents an interface to different hardware platforms. Supported hardware includes commodity NICs, data formats provided by routers, and especially a specialized hardware adapter being developed within the SCAMPI project.

14.2 Progress in year 2003

Four meetings of the project members and two project reviews took place in 2003. Reviews consist of recent result presentation, checking the spent budget and project progress. A Project Officer (a clerk selected by the European Union) and a team of oponents selected by him conduct the project review.

The first review in April 2003 stated that the project fulfilled majority of tasks except for the development of specialized monitoring adapter. This development was the task of the Greek company 4PLUS. Unfortunately, this company 4PLUS had resigned completely this task but refused to return the allocated resources. We presented an alternative solution based on the COMBO6 adapter which is being developed together with several other members of the CESNET Association. The Masaryk University in Brno plays a principal role.

The review resulted in a request to write four additional documents justifying the proposed change of monitoring adapter. These documents convinced our opponents to accept the COMBO6-based monitoring adapter. As a result, the 4PLUS company was excluded from the SCAMPI project and the Masaryk University joined this project. Moreover, the CESNET budget was increased by 3 man-months.

The second review took place in November 2003. Opponents consented to all submitted documents and expressed their satisfaction with the project progress.

14.2.1 Overview of the 2003 events

Members of the SCAMPI project wrote five planned documents (deliverables)

D1.2 - SCAMPI Architecture and Component Design
D1.3 - Final Architecture Design
D2.1 - Preliminary Implementation Report
D2.2 - SCAMPI Prototype Implementation Report
D3.2 - Experimental Plans and Infrastructure Setup

as well as four additional deliverables:

E1.1 - Comparison between the 4Plus and COMBO6 Adapters
E1.2 - Reallocations of Tasks and Funds
E1.3 - COMBO6 Adapter
E1.4 - Description of the Applications and Demonstrators

In addition, two activities focused on SCAMPI presentation took place. The first one was the 1st SCAMPI Workshop held in January in Amsterdam. The second one was the SCAMPI Monitoring and Measurement BoF where a summary of papers related to SCAMPI goals was presented. It was held as a part of the TNC-2003 conference in Zagreb in May 2003.

We are co-authors of most SCAMPI deliverables and main authors of the D3.2 and E1.3 deliverables.

14.3 The COMBO6 monitoring adapter

The COMBO6 card is based on FPGA and therefore it is a flexible device which can be adapted for various applications. High-speed monitoring, as considered in the SCAMPI project, requires an additional daughter card with Ethernet link modules (1 Gbps and 10 Gbps) and a time unit for precise timestamp generation.

The internal structure of the monitoring adapter consists of three levels: hardware, firmware (i.e., the VHDL program defining the structure implemented in FPGA) and the Linux driver.

Hardware: The monitoring adapter is based on a COMBO6 card containing a Virtex II FPGA, SRAM and CAM memories for packet header filtering, DDRAM memory to store selected packets, PCI bus interface and a daughter card connector. The clock unit contains a precise TCXO (Temperature compensated quartz oscillator) and a synchronising circuit using a PPS (Pulse per Second) signal from an external source, (e.g., from a GPS receiver). The clock provides timestamps with the resolution in order of 10 ns, which can generate a unique timestamp for each received packet at a 10 Gbps speed. The absolute accuracy of the clock depends on the synchronisation method; it is better then 5 us if a PPS signal is available and about 1 ms when the NTP protocol is used.
The VHDL program: The VHDL program is the core of the adapter. It implements individual functional blocks in the FPGA structure. Several blocks have been designed as machines called nanoprocessors whose characteristic feature is a limited instruction set; their complexity lies between a finite state machine and a RISC processor. The nanoprogram is interpreted by a firmware block and is stored in SRAM.
Driver: Linux was chosen as the platform for the SCAMPI software. The driver must allow communication between the adapter and higher layers of the SCAMPI architecture. It includes download of the VHDL program, adapter configuration and especially an optimised data transfer from the adapter through the PCI bus. The adapter RAM module is mapped to the user address space to improve the transfer speed.

The development of the adapter was split into two phases:

Phase I: A current version of the COMBO6 and daughter cards with 1 Gbps modules is used in Phase I. An IPv4 packet header filtering unit providing a basic monitoring function is implemented in firmware. The timestamp generation is provided by a separate PCI card.
Phase II: An improved version of the COMBO6 card with higher throughput and a 64-bit PCI bus will be designed and developed. New daughter card with 10 Gbps link modules must be designed, too. Firmware will contain units for application support.

Figure 14.1: Adapter structure, Phase I

Figure 14.2: Adapter structure, Phase II

Structure of adapter functional blocks in both phases is shown in figures:

HFE (Header Field Extractor): This block preprocesses packet headers and transforms them to a unified form.
LUP (Look Up Processor): This block is designed as a nanoprocessor; its task is filtering according to the packet header. A 272-bit wide CAM is used for pattern matching and a unit for arithmetical comparison.
TSU (Timestamp Unit): This block generates timestamps with a 10 ns resolution. Optionally, clock may be synchronised using a PPS (Pulse per Second) signal, e.g., from a GPS receiver.
DRAM (Dynamic RAM): Selected packets are stored in dynamic RAM mapped to the user memory space of the operating system; this allows direct access to data from any monitoring application.
SAU (Sampler Unit): This block implements both deterministic and probabilistic sampling of input data.
STU (Statistical Unit): The statistical unit consists of 256 counter sets for evaluating up to 256 traffic classes. Each set contains a packet counter, accumulators for sum of values and for sum of squared values, as well as registers for maximum and minimum values. The value may represent a packet length or a time distance between two subsequent packets.
PCK (Payload Checker): This block implements filtering based on packet payload content. It can find up to 500 strings, each up to 16 bytes long.

14.4 Planned Activities for 2004

2004 is the last year of the SCAMPI project. Our task will consist mainly of participating in new COMBO6 card design (e.g., the structure of functional blocks, Linux driver, MAPI library). Other important task is organising and testing all layers of the SCAMPI architecture within the framework of WP3 (workpackage 3). CESNET is the leader of this workpackage, responsible for writing the D3.4 - Description of Experiment Results deliverable.

contents