eBPF中的快速内核内流量绘制

IF 2.2 4区计算机科学 Q3 COMPUTER SCIENCE, INFORMATION SYSTEMS

ACM Sigcomm Computer Communication Review Pub Date : 2023-01-01 DOI:10.1145/3594255.3594256

S. Miano, Xiaoqi Chen, Ran Ben Basat, G. Antichi

{"title":"eBPF中的快速内核内流量绘制","authors":"S. Miano, Xiaoqi Chen, Ran Ben Basat, G. Antichi","doi":"10.1145/3594255.3594256","DOIUrl":null,"url":null,"abstract":"The extended Berkeley Packet Filter (eBPF) is an infrastructure that allows to dynamically load and run micro-programs directly in the Linux kernel without recompiling it. In this work, we study how to develop high-performance network measurements in eBPF. We take sketches as case-study, given their ability to support a wide-range of tasks while providing low-memory footprint and accuracy guarantees. We implemented NitroSketch, the state-of-the-art sketch for user-space networking and show that best practices in user-space networking cannot be directly applied to eBPF, because of its different performance characteristics. By applying our lesson learned we improve its performance by 40% compared to a naive implementation.","PeriodicalId":50646,"journal":{"name":"ACM Sigcomm Computer Communication Review","volume":"42 1","pages":"3 - 13"},"PeriodicalIF":2.2000,"publicationDate":"2023-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"3","resultStr":"{\"title\":\"Fast In-kernel Traffic Sketching in eBPF\",\"authors\":\"S. Miano, Xiaoqi Chen, Ran Ben Basat, G. Antichi\",\"doi\":\"10.1145/3594255.3594256\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"The extended Berkeley Packet Filter (eBPF) is an infrastructure that allows to dynamically load and run micro-programs directly in the Linux kernel without recompiling it. In this work, we study how to develop high-performance network measurements in eBPF. We take sketches as case-study, given their ability to support a wide-range of tasks while providing low-memory footprint and accuracy guarantees. We implemented NitroSketch, the state-of-the-art sketch for user-space networking and show that best practices in user-space networking cannot be directly applied to eBPF, because of its different performance characteristics. By applying our lesson learned we improve its performance by 40% compared to a naive implementation.\",\"PeriodicalId\":50646,\"journal\":{\"name\":\"ACM Sigcomm Computer Communication Review\",\"volume\":\"42 1\",\"pages\":\"3 - 13\"},\"PeriodicalIF\":2.2000,\"publicationDate\":\"2023-01-01\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"\",\"citationCount\":\"3\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"ACM Sigcomm Computer Communication Review\",\"FirstCategoryId\":\"94\",\"ListUrlMain\":\"https://doi.org/10.1145/3594255.3594256\",\"RegionNum\":4,\"RegionCategory\":\"计算机科学\",\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"Q3\",\"JCRName\":\"COMPUTER SCIENCE, INFORMATION SYSTEMS\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"ACM Sigcomm Computer Communication Review","FirstCategoryId":"94","ListUrlMain":"https://doi.org/10.1145/3594255.3594256","RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q3","JCRName":"COMPUTER SCIENCE, INFORMATION SYSTEMS","Score":null,"Total":0}

引用次数: 3

摘要

扩展的Berkeley Packet Filter (eBPF)是一种基础结构，它允许直接在Linux内核中动态加载和运行微程序，而无需重新编译它。在这项工作中，我们研究了如何在eBPF中开发高性能的网络测量。我们将草图作为案例研究，因为它们能够支持广泛的任务，同时提供低内存占用和准确性保证。我们实现了用于用户空间网络的最先进草图NitroSketch，并表明用户空间网络中的最佳实践不能直接应用于eBPF，因为它具有不同的性能特征。通过应用我们的经验教训，我们将其性能提高了40%。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

查看原文本刊更多论文

Fast In-kernel Traffic Sketching in eBPF

The extended Berkeley Packet Filter (eBPF) is an infrastructure that allows to dynamically load and run micro-programs directly in the Linux kernel without recompiling it. In this work, we study how to develop high-performance network measurements in eBPF. We take sketches as case-study, given their ability to support a wide-range of tasks while providing low-memory footprint and accuracy guarantees. We implemented NitroSketch, the state-of-the-art sketch for user-space networking and show that best practices in user-space networking cannot be directly applied to eBPF, because of its different performance characteristics. By applying our lesson learned we improve its performance by 40% compared to a naive implementation.

求助全文

通过发布文献求助，成功后即可免费获取论文全文。去求助

来源期刊

ACM Sigcomm Computer Communication Review 工程技术-计算机：信息系统

CiteScore

6.90

自引率

3.60%

发文量

审稿时长

4-8 weeks

期刊介绍： Computer Communication Review (CCR) is an online publication of the ACM Special Interest Group on Data Communication (SIGCOMM) and publishes articles on topics within the SIG''s field of interest. Technical papers accepted to CCR typically report on practical advances or the practical applications of theoretical advances. CCR serves as a forum for interesting and novel ideas at an early stage in their development. The focus is on timely dissemination of new ideas that may help trigger additional investigations. While the innovation and timeliness are the major criteria for its acceptance, technical robustness and readability will also be considered in the review process. We particularly encourage papers with early evaluation or feasibility studies.