WIND RIVER FLOW ANALYSIS ENGINE

Transcription

1 Best-in-Class Deep Packet Inspection and Metadata Extraction for Greater Network Intelligence Wind River Flow Analysis Engine is a deep packet inspection (DPI) and metadata extraction software solution used by telecom equipment manufacturers (TEMs) and solution vendors to embed state-of-the-art flow decoding technology into their applications. Flow Analysis Engine delivers complete visibility into network traffic in real time, including protocol and application classification and identification as well as the extraction of communication metadata. This advanced DPI solution enables developers to inject application-level insight into their solutions. It delivers tremendous application value by going beyond traditional DPI extract protocol and application metadata, enabling a more detailed understanding of network transactions up to the application level. Flow Analysis Engine is one of three critical software components in Wind River Intelligent Network Platform. It can operate as a stand-alone DPI software building block for data plane applications, or it can be used in conjunction with Wind River Application Acceleration Engine and Wind River Content Inspection Engine to build faster, smarter, and more secure network applications. YOUR APPLICATION PROGRAM Reporting Policy Application ID Metadata Packet Flows Application Plugins Social Network Social Network Peer Peer to to Pear Peer Flow Processing Wind River Continuous Updates of Plugins Wind River Flow Analysis Engine Figure 1: Deep traffic visibility within Wind River Flow Analysis Engine Product Overview INNOVATORS START HERE.

2 TOP USE CASES FOR DEEP PACKET INSPECTION AND METADATA EXTRACTION Policy control and charging (PCC) Quality of experience (QoE) Subscriber analytics Wireless LAN infrastructure Application delivery network DeepFlow for security information and event management (SIEM) systems DeepFlow for managed security services provider (MSSP) hosting an SIEM solution DeepFlow for distributed denial-of-service (DDoS) mitigation Next-generation firewalls KEY FEATURES High Performance The only DPI solution that can handle a data plane of greater than 10 Gbps on Linux Optimization for multi-core processors such as Intel and other leading silicon Many configuration options, enabling developers to optimize integration Resiliency, Robustness, and Reliability Ability to function under adverse external conditions (e.g., maliciously forged packets or flows) High performance during difficult situations (e.g., SYN flood attacks, incomplete traffic, application crashes) Reliable decoding of traffic even under unusual circumstances (e.g., tunnels, obfuscated traffic, non-standard protocol behavior) Ease of Use and Simplified Product Development Environment Ready-to-use software, reducing development cycles, costs, and risks Wind River domain expertise in protocol, application, and metadata extraction, enabling you to focus on building complete solutions Future-proof technology with continuously updated protocols and applications Independent core decoding engine and protocol plugin library for fast protocol updates while preserving engine stability Protocol Plugin Creator to add customized protocol and application plugins to Wind River Flow Analysis Engine Comprehensiveness Software libraries with optimized versions for all leading multi-core processors Classification of network flows using stateful DPI and statistical protocol identification Real-time extraction of metadata and content from traffic flows Correlation at flow, session, application, service, and user levels protocol and application plugins to classify flows and extract information Fully configurable engine to maximize performance Designed for both passive mode and inline applications 2 Product Overview

3 Configure, Monitor Flow Class Libraries Accelerated Socket Application UDP or TCP IPV4/IPV6 Flow Classification DPDK User Mode Drivers Proxy 0 Proxy 1 DPDK Libraries Logs Wire Wire Wire Flows Figure 2: Wind River Flow Analysis Engine, a component of Wind River Intelligent Network Platform FEATURES THAT GO BEYOND DPI Protocol signature using layer 7 stateful DPI (no use of TCP/UDP ports) Statistical protocol recognition Automatic decapsulation of tunneled or encapsulated traffic (e.g., Internet Control Message Protocol (ICMP) tunnels) Operation on fragmented, duplicated, and desequenced packets Operation on bidirectional and unidirectional traffic Protection against cyberattacks (e.g., SYN flood attacks) Real-time extraction of traffic metadata for total visibility on network flows Protocol Metadata Extracted Google Ads HTTP TCP GTP UDP IP Advertiser, ad URL, ad title, ad text, +25 others URL, browser, cookies, DNS, authentication information, +60 others Source/destination port, client/server port, +15 others Device, user location, quality of service (QoS) metrics, time/dura tion, +50 others Source/destination port Source/destination address, port, data, +15 others High-speed keyword search leveraging flow metadata Identification of application behavior Delivery of structured traffic information over simple APIs (e.g., Skype VoIP, Chat, or File transfer) Protocol Plugin Creator to easily build additional custom protocol plugins Debugging information to assist development 3 Product Overview

4 Optimized Sessions Dynamic session context containing flow identification and observed metadata Availability of session context to users (or Flow Analysis Engine can use your existing session management) Correlation of control and data sessions Inheritance of traffic metadata on correlated sessions (e.g., SIP session metadata caller inherited in RTP session state) Performance Scalability up to core network speeds at 10s of Gbps Optimized code for the industry s highest-performance multi-core processors such as Intel and other leading silicon Flexible Integration Tunable ratio for granularity of flow analysis or packet processing rate to fit your application requirements User-defined metadata extraction Switchable IP and TCP flow reassembly process for packet reordering Customizable early packet discard mechanism Optional packet pre-filtering: depending on application requirements, all packets or only a subset of packets are parsed KEY BENEFITS Accelerate development cycles: Wind River Flow Analysis Engine is a comprehensive, commercially supported DPI and metadata solution. It has been optimized to run with Wind River Linux and the other engines in Wind River Intelligent Network Platform. Reduce effort: Flow Analysis Engine includes software libraries that are ready to use out of the box. Lower risk: No need to develop and maintain your own highly complex technology Flow Analysis Engine is best-in-class and is backed by the industry leaders in embedded software solutions. Focus resources at the application level: Flow Analysis Engine is full featured, so inhouse engineering resources can focus on higher-value network application development. Build higher-value applications: Flow Analysis Engine delivers complete traffic visibility and enables network intelligence. Building these two capabilities into applications can open up significant opportunities for new services. Use for multiple projects: The same Flow Analysis Engine software technology can be used across products lines and through applications in the network infrastructure. Extend to meet product needs: Custom signatures can be developed independently using Flow Analysis Engine s protocol plugin technology. 4 Product Overview

5 PROTOCOL AND APPLICATION SUPPORT Protocol Plugin Suite protocols and applications identified metadata extracted Examples of Protocols and Applications Identified Mobile telephony: WAP, GTP Audio/video streaming: RTP, RTSP, WMP, YouTube, Dailymotion, Real Player VoIP: H323, SIP, MGCP Enterprise: Citrix, Oracle, SAP, MS Exchange, McAfee Peer-to-peer: emule, BitTorrent Network: TCP/IP, DNS, DHCP Instant messaging: Skype, MSN, Gtalk Webmail: Gmail, Hotmail, Yahoo! Mail Examples of Traffic Metadata Delivered Flow level: IP address, TCP/ UDP ports Session level: Jitter for RTP session, signaling information Service level: VoIP quality metrics per user Application level: Type and name of downloaded file, Google query, etc. User level: Sender, receiver, login WHAT S INCLUDED Software libraries for flow decoding Protocol and application plugins independent from the decoding framework Fully documented APIs, tutorials, code samples, and reference designs to facilitate integration into third-party solutions Protocol plugin watch, and updates as technology evolves Frequent delivery of new protocol plugins Hot updates of protocol and application plugins Protocol Plugin Creator SUPPORTED ENVIRONMENTS Linux Distributions Optimized for Wind River Linux In-house Linux Other CPU Architectures IA/IA-32/ X86_64 Linux User Mode NetLogic XLR 7xx/RMI OS Cavium OCTEON 38xx/Simple Executive Cavium OCTEON 58xx/Simple Executive Cavium OCTEON II For more information, visit or call Maximum Responsiveness to Technology Evolution Continuous protocol evolution watch and frequent updates; typical protocol updates available within days Fast delivery of popular new protocol identifications On-demand development of custom protocol recognition Protocol Plugin Creator to develop your own customized protocol and application plugins Wind River is a world leader in embedded software for intelligent connected systems. The company has been pioneering computing inside embedded devices since 1981, and its technology is found in more than 1 billion products. To learn more, visit Wind River at Wind River Systems, Inc. The Wind River logo is a trademark of Wind River Systems, Inc., and Wind River and VxWorks are registered trademarks of Wind River Systems, Inc. Rev. 08/2014