Análise de eficiência de subsistemas de filtragem e manipulação de pacotes no kernel do Linux

Abstract

SeVen, a software developed in the Networking Laboratory of the Federal University of Paraiba, proved to be suitable for application-layer ltering and low-rate attacks, although it was found that the same was not true for ooding attacks. This work aims to analyze the e ciency of subsystems in the Linux kernel for ltering and manipulation of packets and network frames in order to select future base subsystems for the expansion of the software capacity. For this, four subsystems, tc, xdp, and kernel modules were analyzed using the net lter framework and iptables. Both tc and xdp work by using a newly built kernel technology, eBPF, and uses a virtual machine for the safe and efficient execution of programs. During the tests it was observed a superior efficiency in the discarding of packages and frames of the subsystems based on eBPF, which were chosen for the next version of SeVen, while the net lter and iptables subsystems were less efficient and with limitations of complexity for the development.