Overview / Usage

Achieving full network visibility requires a combination of a wide range of monitoring tools for real-time activities. Fundamental activities include, but are not limited to:

• Efficient traffic steering from the network directly to the monitoring tools;
• Traffic filtering to perform selective analyses with the benefit of a reduced load on the CPU;
• Traffic blocking to implement policies in inline applications.

nBroker is a framework that can be used for traffic steering and filtering at 100 Gbps on Intel FM10000 Red Rock Canyon (RRC) adapters. The FM10000 adapters have an internal switch attached to the external ports of the NIC – those that are physically connected to the cables – and to the internal ports towards the CPU – those seen by the host OS.

Methodology / Approach

nBroker consists of a daemon that drives the RRC switch, and an API that can be used to configure steering and filtering rules. The communication happens over a ZMQ channel. In addition to the API, a command-line tool with auto-completion is also provided to control the adapter.

Technologies Used

Intel FM10k (codename Red Rock Canyon) switching family

Repository

https://github.com/ntop/PF_RING/tree/dev/userland/nbroker

Other links

• nBroker Home Page