Changes between Version 13 and Version 14 of GENIExperimenter/Tutorials/NFV/Ryu/HandlingIntrusionwithRyu


Ignore:
Timestamp:
10/30/17 11:21:23 (6 years ago)
Author:
Nabeel Akhtar
Comment:

--

Legend:

Unmodified
Added
Removed
Modified
  • GENIExperimenter/Tutorials/NFV/Ryu/HandlingIntrusionwithRyu

    v13 v14  
    1313We use the same PI control for load balancing as in [wiki:GENIExperimenter/Tutorials/NFV/Ryu/LoadBalancePIwithRyu Experiment 2], and you can find details about the PI control there.
    1414
    15 == (1) RINA Distributed Application == (Same as Part (1) RINA Distributed Application in [wiki:GENIExperimenter/Tutorials/NFV/Ryu/LoadBalancePIwithRyu Experiment 2]. )
     15== (1) RINA Distributed Application ==
     16(Same as Part (1) RINA Distributed Application in [wiki:GENIExperimenter/Tutorials/NFV/Ryu/LoadBalancePIwithRyu Experiment 2]. )
    1617
    1718First we will run a RINA distributed application to collect the VNF load information on the controller node.
     
    132133
    133134== (2) PI Controller ==
    134 Same as Part (2) PI Controller in [wiki:GENIExperimenter/Tutorials/NFV/Ryu/LoadBalancePIwithRyu Experiment 2].
     135(Same as Part (2) PI Controller in [wiki:GENIExperimenter/Tutorials/NFV/Ryu/LoadBalancePIwithRyu Experiment 2]. )
     136
     137{{{
     138#!html
     139<table id="Table_02" width = "1150" border="0" cellpadding="0" cellspacing="10" >
     140 <tr>
     141<td> <img src = "http://csr.bu.edu/rina/grw-bu2016/tutorial_files/image068.gif" > </td>
     142<td>   The PI-controller gets the load information of VNF1 and VNF2 using RINA's distributed application and makes the load balancing decision.
     143 </td></tr></table>
     144}}} 
     145
     146
     147 
     148
     149 The figure below shows the block diagram of the Proportional Integral (PI) controlled NFV system.
     150
     151{{{
     152#!html
     153
     154<table id="Table_02" width = "1150" border="0" cellpadding="0" cellspacing="0" align="center" >
     155<tr>
     156<td><img src="http://csr.bu.edu/rina/grw-bu2016/tutorial_files/image074.gif" hspace=2/></td></tr>
     157
     158<tr><td> <i style="font-size:9px">Block diagram of the PI-controller NFV system. System load L and target load T(s)=T/s of VNF1 is used to compute X, i.e. ratio of traffic diverted to VNF2. K` = K/T.</i></td></tr>
     159</table>
     160
     161 }}}
     162
     163 The RINA-based distributed monitoring application provides the VNF1 state (average CPU load) information L(t) to the PI controller. The maximum capacity of a VNF instance is T. If the load on VNF1 exceeds T, new traffic flows are forwarded to a second VNF instance, VNF2. Assuming instantaneous feedback / measured load L(t), the PI control equation is given by:
     164
     165
     166{{{
     167#!html
     168<img src="http://csr.bu.edu/rina/grw-bu2016/tutorial_files/image076.gif" hspace=70>
     169
     170 }}}
     171
     172 The code for the PI controller is based on the following algorithm. Input ''IDS,,load,,.txt'' is the file generated by the RINA distributed application. This file has load information of the VNFs.
     173
     174{{{
     175#!html
     176<img src="http://csr.bu.edu/rina/grw-bu2016/tutorial_files/image078.gif" hspace=40>
     177
     178 }}}
     179
     180  1.     To run the PI-controller, open a new controller window and execute:
     181
     182         - ''' cd ~/Control/PI_controller '''
     183         - ''' python PI_controller.py ~/Control/RINA/NFV1.txt'''
     184
     185
     186
     187 Note that here we are directing ''PI_controller.py'' to the ''NFV1.txt'' file that is constantly updated by the RINA distributed application with the load information of VNFs.
     188  2.     You should see the VNF state information printed on the screen. A sample output is shown below.
     189
     190{{{
     191#!html
     192<img src="http://csr.bu.edu/rina/grw-bu2016/nfv_ryu/pics/PIPic.png" hspace=40>
     193
     194 }}}
     195 Here the target load on VNF1 is 30.0% of CPU usage, i.e. if the CPU load on VNF1 is more than 30.0%, traffic flows will be diverted to VNF2. The `current CPU load` shows the load on VNF1. The next line of the output shows the percentage of flows that will be directed to VNF2 and the last line shows the flows that were being directed to VNF2 before the current control update.
     196
     197 '''Do not close this window; leave the PI controller running.'''
     198
    135199
    136200== (3) PI-based Ryu Controller ==
    137 Same as Part (3) PI-based Ryu Controller in [wiki:GENIExperimenter/Tutorials/NFV/Ryu/LoadBalancePIwithRyu Experiment 2]. 
     201(Same as Part (3) PI-based Ryu Controller in [wiki:GENIExperimenter/Tutorials/NFV/Ryu/LoadBalancePIwithRyu Experiment 2]. )
     202
     203 Now we will run the Ryu controller that will get the load balancing decision from the PI-controller and direct the flows accordingly.
     204
     205 1.     First we will update the ''port.config'' file to direct the controller to the ''NFV_ratio_PI.txt'' file generated by the PI-controller, which has the load balancing decision information. In a new controller window, execute:
     206
     207         - ''' nano /tmp/ryu/ryu/app/nfv.config'''
     208 
     209   o   Change the value of '''controller_type''' to '''PI''' [[BR]]
     210   o   Change the value of '''''file_path_pi''''' to the text file that has the PI controller`s  output.[[BR]]
     211    '''''/users/<!UserName>/Control/PI_controller/NFV_ratio_PI.txt'''''[[BR]]
     212    Change the '''''<!UserName>''''' to your user name.[[BR]]
     213
     214
     215 2.     Now we can run the Ryu controller. Execute
     216
     217        - ''' /tmp/ryu/bin/ryu-manager --verbose /tmp/ryu/ryu/app/nfv_controller.py'''
     218
     219 == (4) Run Snort and Generate Traffic ==
     220
     221 1.     First we will run Snort IDS on VNF1 and VNF2. In separate windows for VNF1 and VNF2, execute the following command:
     222
     223          - '''sudo /usr/local/bin/snort -A full -dev -i eth1'''
     224
     225
     226
     227 2.     We will use the iperf application to generate flows between a source and destination. If iperf is not installed on your nodes, execute:
     228
     229  - ''' sudo apt-get install iperf '''
     230
     231
     232 3.     Run iperf server on the destination node:
     233
     234  - ''' iperf -u -s '''
     235
     236
     237 4.     Now we will generate traffic from the sources (s1 and s2) to the destination node using ''iperf'' and see how it effects the CPU utilization at VNF1 and VNF2 running Snort IDS. Note that if we run multiple instances of ''iperf'', we can generate significant load on the VNF instances. To run ''iperf'' client on a source, execute:
     238
     239  - ''' iperf -u -c destination -t 500 & '''
     240
     241{{{
     242#!html
     243<table id="Table_02" width = "1150" border="0" cellpadding="0" cellspacing="10" >
     244 <tr>
     245<td> <img src = "http://csr.bu.edu/rina/grw-bu2016/tutorial_files/image068.gif" > </td>
     246<td>  <i>Note that you can run multiple instances of iperf by running <span style="background:#c0c0c0"> iperf -c destination -t 500 & </span> multiple times in s1 and s2 nodes. This flow lasts for 500 seconds. For this experiment, you may try to run 2-3 iperf instances. To kill all the flows generated at a node, run <span style="background:#c0c0c0"> killall –v iperf </span> </i>
     247 </td></tr></table>
     248}}}
     249
     250 5.     Now if you look at the controller window, which is running the PI-controller, you can see the load on VNF1 has significantly increased. If the load is more than 30%, some percentage of the traffic flows will be diverted to VNF2.
     251
     252{{{
     253#!html
     254<table id="Table_02" width = "700" border="0" cellpadding="0" cellspacing="10" >
     255 <tr>
     256<td> <img src = "http://csr.bu.edu/rina/grw-bu2016/tutorial_files/image022.gif"> </td>
     257<td> <b>OPTIONAL: Review the PI Ryu Controller Code</b> </td> </tr></table>
     258}}}
     259
     260
     261The Ryu controller gets the load balancing information from the output text file generated by the PI-controller. Based on the  value of the control variable  (variable X), it sends each new flow to either VNF1 or VNF2. The algorithm for the PI-based OVS controller is shown below.
     262
     263
     264{{{
     265#!html
     266<img src="http://csr.bu.edu/rina/grw-bu2016/tutorial_files/image092.gif" hspace=40>
     267
     268 }}}
     269
    138270
    139271'''Note: You can see in "nfv.config" that the information of the intrusion traffic is located in the file ''/tmp/attacker.txt'' on the controller VM, which is outputted by the RINA distributed application. Make sure the file is empty each time you run this experiment.'''