Second IXP 2400 assignment. Due: June 3 at class time. Turn in: listings on paper. Teams of 2 are ok. Let me know who the team members are please. ---------------------------------------------------------------------- Goals: Do 1 small and 1 large task: Small tasks: Pick 1 small "hardwired" filter from ourmon from the following list: 1. fixed_cast: L2 destination mac byte counts. L2 is divided up by destination MAC into multicast/unicast/broadcast 2. fixed_cast_pkts: L2 as above but count pkts, not bytes. 3. fixed_size: L2 filter, classifies packets into 4 sizes: it displays pkts/sec. This filter counts packets within four fixed byte bucket sizes, where the packet is <= 100 bytes (tiny), <= 500 (small), <= 1000 (medium), or <= 1500 bytes (big). 4. or do fixed_ipproto_pkts (tcp/udp/icmp/xtra (none of those) which is a L3 filter. The current one counts bytes. count pkts instead. Large tasks: 1. either port the bpf (the function bpf_filter) to the 2400 or 2. port the topn hash list mechanism (in the ourmon src, you want the search/insert function from the hashsort.c module, as well as the barthash.c function, which you want to make "inline" (just do it... don't make it a function). In general, we want "bpf_switch" and/or the search/insert function for topn flows to be done in the uEs. Code for printing out the bpf result and clearing the counters, and/or dynamic list should be done on the xscale. Feel free to work out a design and run it by Jim. Keep your bpf work simple; e.g., you may choose a simple expression like "tcp" or "host 10.0.0.2", compile it, and then build a C data expression for it (as shown on the bpf man page). You don't need to do more than one expression, although your bpf_filter function should strive to be a general solution. Although it would be a great thing if you set up an array of BPF expressions and looped through them with the uE ... that is not necessary. However this condition is necessary: Chris's counter code works on at least 2 uEs. Your code must also work on at least 2 uEs. ... ---------------------------------------------------------------------- Background info: Ourmon web page: --------------- ourmon.cat.pdx.edu/ourmon - ourmon live web page. ourmon running in the PSU network. also includes the current mon.lite page, all graphics/reports, and the current source code. current src is release 2.3. ourmon.cat.pdx.edu/ourmon/info.html - technical report that discusses how ourmon works in overview, and gives examples and discussion for various filters. ixp handouts at: --------------- http://www.cs.pdx.edu/~jrb/ui/ixp/ including: Chris Hall baby ourmon (countv2) is your code base and is on the ixp web page. Harkirat Singh and his group/bpf work for IXP1200 from last year. bpf handouts at: --------------- http://www.cs.pdx.edu/~jrb/ui/handouts/bpf/ (bpf.ps is the BSD man page). --------------------------------------------------------------------- So how do we send the ixp test packets? Keep in mind that all of the interfaces on our ixp/linux boxes are hooked up to the switch gollum.cs.pdx.edu: 1. on your linux host, use "proxy arp" to put in a fake arp entry. this will allow you to send packets to a fake MAC/IP destination. [root@zymurgy root]# arp -i eth0 -s 10.3.3.3 00:01:02:03:04:06 [root@zymurgy root]# ping -n 10.3.3.3 PING 10.3.3.3 (10.3.3.3) from 10.0.0.1 : 56(84) bytes of data. --- 10.3.3.3 ping statistics --- 1 packets transmitted, 0 received, 100% loss, time 0ms You can now send ICMP packets at least ... 2. you can download a package like nemesis that allows you to construct packets of your choice. tcp/udp ... whatever. E.g., you can use it to make tcp syn packets to send to port 25, with whatever MAC address, IP address, TCP ports you want. Simply run it in a shellscript from your linux host. http://nemesis.sourceforge.net/ If you have a particularly good "packet" crafted, please include (perhaps a shellscript ...) that info with your documentation and code when you turn your project in.