LinuxCon 2015 Stateful NAT with OVS

Aug 19, 20155 likes4,186 views

As containers are being deployed as part of multi tenant clusters, virtual multi layer switches become essential to interconnect containers while providing isolation guarantees. Assigning tenants their own private networks requires stateful network address translation (NAT) implemented in a scalable architecture to expose containers to public networks. Existing virtual switches integrated into the Linux kernel did not support stateful NAT so far. This presentation introduces a new virtual NAT service deployable as container built using existing kernel functionality such as network namespaces, routing rules and Netfilter to provide NAT services to existing virtual switches such as Open vSwitch and the Linux bridge but also the core L3 layer of Linux.

Stateful NAT with Open vSwitch
LinuxCon 2015, Seattle
Thomas Graf
Kernel & Open vSwitch Team
Noiro Networks (Cisco)

Agenda
● What is Open vSwitch
● Stateful NAT options for Open vSwitch
● Demo
● Q&A

Open vSwitch Connects
VM
Host
NIC
Container
Tunnel
Cloudy
Stuff

● Highly scaleable multi layer virtual switch for hypervisors
– Apache License (User Space), GPL (Kernel)
● Extensive flow table programming capabilities
– OpenFlow 1.0 – 1.5 (some partial)
– Vendor extensions
● Designed to manage overlay networks
– VXLAN (+ extensions), GRE, Geneve, LISP, STT, VLAN, ...
● Remote management protocol (OVSDB)
● Monitoring capabilities
Open vSwitch in a Nutshell

NAT Dependency:
Connection Tracking
● We are adding the ability to use the conntrack module from Linux
– Stateful tracking of flows
– Supports ALGs to punch holes for related “data” channels
● FTP, TFTP, SIP
● Implement a distributed firewall with enforcement at the edge
– Better performance
– Better visibility
● Introduce new OpenFlow extensions:
– Action to send to conntrack
– Match fields on state of connection
● Have prototype working. Expect to ship as part of OVS in next
release.

Netfilter Conntrack Integration
OVS Flow Table
Netfilter
Connection Tracker
CT
Table
Userspace Netlink API
Create & Update
CT entries
Connection State (conn_state=)
conntrack()
Recirculation
1
2
3
4

Zone 1
Connection Tracking Zones
OVS Flow Table
CT
Table
Zone 2
CT
Table
Netfilter
Connection Tracker

● Route packets through separate NAT network namespace
● Utilize Netfilter chains to perform NAT
● Pro: Working now
● Con: Requires linear Netfilter chain traversal
NAT with Open vSwitch
The Now
● Native OpenFlow NAT action
● Pro: Fast, clean & available to orchestration tools
● Con: Tricky to get right
The Future

Possible Future 1:
Native stateful NAT
OVS Flow Table
Netfilter
Connection Tracker CT
Table
Create & Update
CT entries
conntrack()
Recirculation
1
2
3
4
Netfilter
NAT
nat()

Possible Future 2:
Customizable NAT through eBPF
OVS Flow Table
Netfilter
Connection Tracker CT
Table
Create & Update
CT entries
conntrack()
Recirculation
1
2
3
4
BPF prog
performing NAT
bpf()

What is available now:
NAT with Netfilter
OVS Flow Table
Netfilter
Connection Tracker CT
Table
Create & Update
CT entries
conntrack()
Final L2/L3 decision
1
2
3
Namespace w/
-j SNAT / -j DNAT
output() to
internal port
5
4
Routing:
ip rule add iif nat-gw lookup 100
ip route add 1.1.1.1/32 dev nat-gw
ip route add default
via 1.1.1.1 table 100

Q&A
Contact:
● E-Mail: tgraf@suug.ch
● Twitter: @tgraf__

Open vSwitch (OVS) has long been a critical component of the Neutron's reference implementation, offering reliable and flexible virtual switching for cloud environments. Being an early adopter of the OVS technology, Neutron's reference implementation made some compromises to stay within the early, stable featureset OVS exposed. In particular, Security Groups (SG) have been so far implemented by leveraging hybrid Linux Bridging and IPTables, which come at a significant performance overhead. However, thanks to recent developments and ongoing improvements within the OVS community, we are now able to implement feature-complete security groups directly within OVS. In this talk we will summarize the existing Security Groups implementation in Neutron and compare its performance with the Open vSwitch-only approach. We hope this analysis will form the foundation of future improvements to the Neutron Open vSwitch reference design.

The Next Generation Firewall for Red Hat Enterprise Linux 7 RCThomas Graf

Open vSwitch - Stateful Connection Tracking & Stateful NATThomas Graf

Cilium - API-aware Networking and Security for Containers based on BPFThomas Graf

Cilium provides network security and visibility for microservices. It uses eBPF/XDP to provide fast and scalable networking and security controls at layers 3-7. Key features include identity-based firewalling, load balancing, and mutual TLS authentication between services. It integrates with Kubernetes to apply network policies using standard Kubernetes resources and custom CiliumNetworkPolicy resources for finer-grained control.

eBPF - Rethinking the Linux KernelThomas Graf

The Linux kernel is undergoing the most fundamental architecture evolution in history and is becoming a microkernel. Why is the Linux kernel evolving into a microkernel? The potentially biggest fundamental change ever happening to the Linux kernel. This talk covers how companies like Facebook and Google use BPF to patch 0-day exploits, how BPF will change the way features are added to the kernel forever, and how BPF is introducing a new type of application deployment method for the Linux kernel.

Cilium - Fast IPv6 Container Networking with BPF and XDPThomas Graf

We present a new open source project which provides IPv6 networking for Linux Containers by generating programs for each individual container on the fly and then runs them as JITed BPF code in the kernel. By generating and compiling the code, the program is reduced to the minimally required feature set and then heavily optimised by the compiler as parameters become plain variables. The upcoming addition of the Express Data Plane (XDP) to the kernel will make this approach even more efficient as the programs will get invoked directly from the network driver.

BPF & Cilium - Turning Linux into a Microservices-aware Operating SystemThomas Graf

Container runtimes cause Linux to return to its original purpose: to serve applications interacting directly with the kernel. At the same time, the Linux kernel is traditionally difficult to change and its development process is full of myths. A new efficient in-kernel programming language called eBPF is changing this and allows everyone to extend existing kernel components or glue them together in new forms without requiring to change the kernel itself.

DevConf 2014 Kernel Networking WalkthroughThomas Graf

This presentation features a walk through the Linux kernel networking stack covering the essentials and recent developments a developer needs to know. Our starting point is the network card driver as it feeds a packet into the stack. We will follow the packet as it traverses through various subsystems such as packet filtering, routing, protocol stacks, and the socket layer. We will pause here and there to look into concepts such as segmentation offloading, TCP small queues, and low latency polling. We will cover APIs exposed by the kernel that go beyond use of write()/read() on sockets and will look into how they are implemented on the kernel side.

2015 FOSDEM - OVS Stateful ServicesThomas Graf

This document discusses Open vSwitch and its support for stateful services like connection tracking (conntrack) and network address translation (NAT). Open vSwitch is designed to manage overlay networks and provides programmable flow tables and remote management. It aims to integrate conntrack to enable stateful firewalling and NAT functions. This will allow matching on connection states and leveraging existing Linux conntrack and NAT modules. Examples are given of how conntrack and NAT rules could be implemented using these new Open vSwitch capabilities.

Accelerating Envoy and Istio with Cilium and the Linux KernelThomas Graf

The document discusses how Cilium can accelerate Envoy and Istio by using eBPF/XDP to provide transparent acceleration of network traffic between Kubernetes pods and sidecars without any changes required to applications or Envoy. Cilium also provides features like service mesh datapath, network security policies, load balancing, and visibility/tracing capabilities. BPF/XDP in Cilium allows for transparent TCP/IP acceleration during the data phase of communications between pods and sidecars.

BPF: Next Generation of Programmable DatapathThomas Graf

LinuxCon 2015 Linux Kernel Networking WalkthroughThomas Graf

This presentation features a walk through the Linux kernel networking stack for users and developers. It will cover insights into both, existing essential networking features and recent developments and will show how to use them properly. Our starting point is the network card driver as it feeds a packet into the stack. We will follow the packet as it traverses through various subsystems such as packet filtering, routing, protocol stacks, and the socket layer. We will pause here and there to look into concepts such as networking namespaces, segmentation offloading, TCP small queues, and low latency polling and will discuss how to configure them.

Cilium - BPF & XDP for containersDocker, Inc.

Cilium - Network security for microservicesThomas Graf

The document discusses how BPF and XDP are revolutionizing network security and performance for microservices. BPF allows profiling, tracing, and running programs at the network driver level. It also enables highly performant networking functions like DDoS mitigation using XDP. Cilium uses BPF to provide layer 3-7 network security for microservices with policies based on endpoints, identities, and HTTP protocols. It integrates with Kubernetes to define network policies and secure microservice communication and APIs using eBPF programs for filtering and proxying.

Using IO Visor to Secure Microservices Running on CloudFoundry [OpenStack Sum...IO Visor Project

As microservices grow, traditional firewall rules based on network ACLs are no longer scalable and fall short of providing fine-grained enforcement. Group Based Policy (GBP) is a flexible policy language that allows users to specify policy enforcement based on intent, independent of network infrastructure and IP addressing. Using micro-segmented virtual domains, administrators can define policies at a centralized location and use IO Visor technology for distributed enforcement. This provides infrastructure independent rules, template-based policy definitions, and scale-out policy enforcement for a solution that secures and scales with microservices. This session will be presented by members of the IO Visor community and will cover how IO Visor technology can be used to define and enforce GBP. The discussion will also cover using GBP for cloud foundry application spaces where microservices are deployed and need scalable, efficient security policies.

Kernel Recipes 2017 - EBPF and XDP - Eric LeblondAnne Nicolas

Berkeley Packet Filter is an old friend for most people that deal with network under Linux. But its extended version eBPF is completely redefining the scope of usage and interaction with the kernel. It can indeed be used to instrument most parts of the kernel. This goes from network tracing to process or I/O monitoring. This talk will provide an overview of eBPF, from concept to tools like BCC. It will then focus on XDP for eXtreme Data Path and the possible applications in term of networking provided by this new framework. Eric Leblond, Stamus Network

Cilium - Bringing the BPF Revolution to Kubernetes Networking and SecurityThomas Graf

BPF is one of the fastest emerging technologies of the Linux kernel. The talk provides an introduction to Cilium which brings the powers of BPF to Kubernetes and other orchestration systems to provide highly scalable and efficient networking, security and load balancing for containers and microservices. The talk will provide an introduction to the capabilities of Cilium today but also deep dives into the emerging roadmap involving networking at the socket layer and service mesh datapath capabilities to provide highly efficient connectivity between cloud native apps and sidecar proxies.

Ebpf ovsconf-2016Cheng-Chun William Tu

The document discusses using eBPF to offload Open vSwitch (OVS) flow processing. It proposes replacing the entire OVS kernel datapath with an eBPF datapath to improve extensibility and reduce dependencies on kernel versions. The eBPF datapath would handle packet parsing, flow table lookups, and action execution. Performance evaluation shows the eBPF datapath can achieve over 1 Mpps for simple actions but has room for improvement in more complex processing like parsing.

LF_DPDK17_Accelerating P4-based Dataplane with DPDKLF_DPDK

This document discusses accelerating P4-based data planes using DPDK with BMv2. It presents BMAcc, which leverages DPDK for faster packet I/O compared to BMv2. BMAcc applies optimizations like removing redundant memory copies and using multithreading. Evaluation shows BMAcc achieves line rate performance and outperforms BMv2, especially for small packets. Further optimizations are needed to address parser impact on 64-byte packets. BMAcc is a practical approach for high performance P4 data planes on multicore platforms.

LF_DPDK_Mellanox bifurcated driver modelLF_DPDK

The Mellanox PMD allows DPDK applications to directly access Mellanox NICs using the Raw Ethernet Accelerated Verbs API from libibverbs. It provides a fast data path while the kernel still controls the NIC and handles the control plane. Unlike other PMDs, the Mellanox PMD is a separate userspace application. Multiple DPDK applications can also run on a single Mellanox device and steer traffic between each other and the kernel without needing SR-IOV.

LF_DPDK17_GRO/GSO Libraries: Bring Significant Performance Gains to DPDK-base...LF_DPDK

This document provides an overview of GRO and GSO in DPDK. It discusses how GRO and GSO can be used to reduce packet processing overheads by merging or splitting packets. It describes the GRO and GSO algorithms used in DPDK to handle packets in a lightweight manner. It also outlines an experiment that shows the performance improvements of DPDK GRO and GSO compared to no offloading or Linux offloading.

Linux Kernel Cryptographic API and Use CasesKernel TLV

The Linux kernel has a rich and modular cryptographic API that is used extensively by familiar user facing software such as Android. It's also cryptic, badly documented, subject to change and can easily bite you in unexpected and painful ways. This talk will describe the crypto API, provide some usage example and discuss some of the more interesting in-kernel users, such as DM-Crypt, DM-Verity and the new fie system encryption code. Gilad Ben-Yossef is a principal software engineer at ARM. He works on the kernel security sub-system and the ARM CryptCell engine. Open source work done by Gilad includes an experiment in integration of network processors in the networking stack, a patch set for reducing the interference caused to user space processes in large multi-core systems by Linux kernel “maintenance” work and on SMP support for the Synopsys Arc processor among others. Gilad has co-authored O’Reilly’s “Building Embedded Linux Systems” 2nd edition and presented at such venues as Embedded Linux Conference Europe and the Ottawa Linux Symposium, as well as co-founded Hamakor, an Israeli NGO for the advancement for Open Source and Free Software in Israel. When not hacking on kernel code you can find Gilad meditating and making dad jokes on Twitter.

P4-based VNF and Micro-VNF Chaining for Servers With Intelligent Server AdaptersOpen-NFP

Commodity servers equipped with intelligent server adapters (ISAs) are being used as platforms for Network Functions Virtualization (NFV). The network traffic processing required by a specific use case is frequently expressed by forming a chain of Virtual Network Functions (VNFs). This demonstration illustrates that VNFs in the chain can be hosted on the server CPU or on the ISA. It furthermore illustrates that VNFs can be decomposed into components called Micro-VNFs, with the components again being hosted on the server CPU and/or the ISA. A P4 program (compiled to native code running on the ISA) defines the overall semantics of the datapath within an ISA equipped server and expresses how VNFs and Micro-VNFs should be composed within this platform. We show how mechanisms like tunnels and service headers programmed using P4 are employed to establish the VNF service chain across multiple network nodes. David George Lead Engineer, Netronome David George is a lead engineer on the Netronome SDK team and is primarily responsible for Netronome's P4 data plane. He has previously been worked on the SDK simulator and x86 data plane components. He holds a Masters of Electrical Engineering from the University of Cape Town.

LF_OVS_17_OVN and Containers - An update.LF_OpenvSwitch

This document discusses integrating Open vSwitch (OVS) and Open Virtual Network (OVN) with containers and orchestrators like Docker and Kubernetes. It provides examples of using OVS and OVN commands to connect containers running in different namespaces to logical switches managed by OVN. It also describes how OVN implements Kubernetes networking concepts like pods, services, load balancing, and network policies using logical ports, switches and routers.

DockerCon 2017 - Cilium - Network and Application Security with BPF and XDPThomas Graf

This talk will start with a deep dive and hands on examples of BPF, possibly the most promising low level technology to address challenges in application and network security, tracing, and visibility. We will discuss how BPF evolved from a simple bytecode language to filter raw sockets for tcpdump to the a JITable virtual machine capable of universally extending and instrumenting both the Linux kernel and user space applications. The introduction is followed by a concrete example of how the Cilium open source project applies BPF to solve networking, security, and load balancing for highly distributed applications. We will discuss and demonstrate how Cilium with the help of BPF can be combined with distributed system orchestration such as Docker to simplify security, operations, and troubleshooting of distributed applications.

EBPF and Linux NetworkingPLUMgrid

In this session, we’ll review how previous efforts, including Netfilter, Berkley Packet Filter (BPF), Open vSwitch (OVS), and TC, approached the problem of extensibility. We’ll show you an open source solution available within the Red Hat Enterprise Linux kernel, where extending and merging some of the existing concepts leads to an extensible framework that satisfies the networking needs of datacenter and cloud virtualization.

DPDK Summit 2015 - HP - Al SandersJim St. Leger

LF_OVS_17_LXC Linux Containers over Open vSwitchLF_OpenvSwitch

This document discusses using LXC Linux containers over Open vSwitch (OVS) for container networking. It provides information on the Orabuntu-LXC project which builds and installs OVS and LXC to deploy containerized Oracle software. It describes how LXC 2.1.0 added explicit support for OVS and how OVS can be configured as a systemd service. It also discusses using OVS with containerized DNS/DHCP and sending container traffic over GRE tunnels.

Linux Networking ExplainedThomas Graf

Linux offers an extensive selection of programmable and configurable networking components from traditional bridges, encryption, to container optimized layer 2/3 devices, link aggregation, tunneling, several classification and filtering languages all the way up to full SDN components. This talk will provide an overview of many Linux networking components covering the Linux bridge, IPVLAN, MACVLAN, MACVTAP, Bonding/Team, OVS, classification & queueing, tunnel types, hidden routing tricks, IPSec, VTI, VRF and many others.

Cilium - BPF & XDP for containersThomas Graf

The document discusses a cluster-wide label ID table that allows for efficient policy enforcement across frontend, backend, and load balancer systems. A single hash table lookup is needed regardless of policy complexity thanks to an ID carried in network packets. Benchmark results show the approach can efficiently handle everything from small HTTP requests to ultra HD videos even with 10,000 policies on a 24-core server.

More Related Content

What's hot (20)

2015 FOSDEM - OVS Stateful ServicesThomas Graf

Accelerating Envoy and Istio with Cilium and the Linux KernelThomas Graf

BPF: Next Generation of Programmable DatapathThomas Graf

LinuxCon 2015 Linux Kernel Networking WalkthroughThomas Graf

Cilium - BPF & XDP for containersDocker, Inc.

Cilium - Network security for microservicesThomas Graf

Using IO Visor to Secure Microservices Running on CloudFoundry [OpenStack Sum...IO Visor Project

Kernel Recipes 2017 - EBPF and XDP - Eric LeblondAnne Nicolas

Cilium - Bringing the BPF Revolution to Kubernetes Networking and SecurityThomas Graf

Ebpf ovsconf-2016Cheng-Chun William Tu

LF_DPDK17_Accelerating P4-based Dataplane with DPDKLF_DPDK

LF_DPDK_Mellanox bifurcated driver modelLF_DPDK

LF_DPDK17_GRO/GSO Libraries: Bring Significant Performance Gains to DPDK-base...LF_DPDK

Linux Kernel Cryptographic API and Use CasesKernel TLV

P4-based VNF and Micro-VNF Chaining for Servers With Intelligent Server AdaptersOpen-NFP

LF_OVS_17_OVN and Containers - An update.LF_OpenvSwitch

DockerCon 2017 - Cilium - Network and Application Security with BPF and XDPThomas Graf

EBPF and Linux NetworkingPLUMgrid

DPDK Summit 2015 - HP - Al SandersJim St. Leger

LF_OVS_17_LXC Linux Containers over Open vSwitchLF_OpenvSwitch

2015 FOSDEM - OVS Stateful ServicesThomas Graf

Accelerating Envoy and Istio with Cilium and the Linux KernelThomas Graf

BPF: Next Generation of Programmable DatapathThomas Graf

LinuxCon 2015 Linux Kernel Networking WalkthroughThomas Graf

Cilium - BPF & XDP for containersDocker, Inc.

Cilium - Network security for microservicesThomas Graf

Using IO Visor to Secure Microservices Running on CloudFoundry [OpenStack Sum...IO Visor Project

Kernel Recipes 2017 - EBPF and XDP - Eric LeblondAnne Nicolas

Cilium - Bringing the BPF Revolution to Kubernetes Networking and SecurityThomas Graf

Ebpf ovsconf-2016Cheng-Chun William Tu

LF_DPDK17_Accelerating P4-based Dataplane with DPDKLF_DPDK

LF_DPDK_Mellanox bifurcated driver modelLF_DPDK

LF_DPDK17_GRO/GSO Libraries: Bring Significant Performance Gains to DPDK-base...LF_DPDK

Linux Kernel Cryptographic API and Use CasesKernel TLV

P4-based VNF and Micro-VNF Chaining for Servers With Intelligent Server AdaptersOpen-NFP

LF_OVS_17_OVN and Containers - An update.LF_OpenvSwitch

DockerCon 2017 - Cilium - Network and Application Security with BPF and XDPThomas Graf

EBPF and Linux NetworkingPLUMgrid

DPDK Summit 2015 - HP - Al SandersJim St. Leger

LF_OVS_17_LXC Linux Containers over Open vSwitchLF_OpenvSwitch

Viewers also liked (18)

Linux Networking ExplainedThomas Graf

Cilium - BPF & XDP for containersThomas Graf

Cilium - Container Networking with BPF & XDPThomas Graf

This talk demonstrates that programmability and performance does not require user space networking, it can be achieved in the kernel by generating BPF programs and leveraging the existing kernel subsystems. We will demo an early prototype which provides fast IPv6 & IPv4 connectivity to containers, container labels based security policy with avg cost O(1), and debugging and monitoring based on the per-cpu perf ring buffer. We encourage a lively discussion on the approach taken and next steps.

SDN & NFV Introduction - Open Source Data Center NetworkingThomas Graf

This document introduces software defined networking (SDN) and network functions virtualization (NFV) concepts. It discusses challenges with traditional networking and how SDN and NFV address these by decoupling the control and data planes, centralizing network intelligence, and abstracting the underlying network infrastructure. It then provides examples of open source SDN technologies like OpenDaylight, Open vSwitch, and OpenStack that can be used to build programmable software-defined networks and virtualized network functions.

The linux networking architecturehugo lu

The document discusses Linux networking architecture and covers several key topics in 3 paragraphs or less: It first describes the basic structure and layers of the Linux networking stack including the network device interface, network layer protocols like IP, transport layer, and sockets. It then discusses how network packets are managed in Linux through the use of socket buffers and associated functions. The document also provides an overview of the data link layer and protocols like Ethernet, PPP, and how they are implemented in Linux.

OpenvSwitch Deep Diverajdeep

The 100 - {dive} : eventIRT b-com

Red Hat demo of OpenStack and ODL at ODL summit 2016 RedHatTelco

Why is PHP AwesomeJeremy Coates

University of Manchester: COMP101 Guest Lecture Monday 10th March, 11am Kilburn LT1.1 This talk will argue that PHP's bad reputation is a thing of the past and look at where and how PHP is used in the wild. We will describe some really useful tools and libraries which people can take away and play with. We will touch on the jobs market for PHP, agency working and how to get involved. We will finally talk about the huge community for PHP around the world but also specifically in Manchester. Speaker Biographies: Steph Cook @steph_cook22 and Damien Walsh @themainframe are web developers @magma_digital and recent graduates of @csmcr. Jeremy Coates @phpcodemonkey is the Managing Director of Magma Digital, the leading software development agency in Lancashire.

Pipework: Software-Defined Network for Containers and DockerJérôme Petazzoni

Pipework lets you connect together containers in arbitrarily complex scenarios. Pipework uses cgroups and namespaces and works with "plain" LXC containers (created with lxc-start), and with the awesome Docker. It's nothing less than Software-Defined Networking for Linux Containers! This is a short presentation about Pipework, given at the Docker Networking meet-up November 6th in Mountain View. More information: - https://github.com/jpetazzo/pipework - http://www.meetup.com/Docker-Networking/

Netfilter: Making large iptables rulesets scalebrouer

CETH for XDP [Linux Meetup Santa Clara | July 2016] IO Visor Project

This document discusses CETH (Common Ethernet Driver Framework), which aims to improve kernel networking performance for virtualization. CETH simplifies NIC drivers by consolidating common functions. It supports various NICs and accelerators. CETH features efficient memory and buffer management, flexible TX/RX scheduling, and a customizable metadata structure. It is being simplified to work with XDP for even higher performance network I/O processing in the kernel. Next steps include further optimizations and measuring performance gains when using CETH with XDP and virtualized environments.

Testing with CodeceptionJeremy Coates

進階嵌入式作業系統設計與實做 (2015 年秋季 ) 課程說明National Cheng Kung University

Mysql Explain ExplainedJeremy Coates

2016 年春季嵌入式作業系統課程說明National Cheng Kung University

Interpreter, Compiler, JIT from scratchNational Cheng Kung University

Making Linux do Hard Real-timeNational Cheng Kung University

This document discusses making Linux capable of hard real-time performance. It begins by defining hard and soft real-time systems and explaining that real-time does not necessarily mean fast but rather determinism. It then covers general concepts around real-time performance in Linux like preemption, interrupts, context switching, and scheduling. Specific features in Linux like RT-Preempt, priority inheritance, and threaded interrupts that improve real-time capabilities are also summarized.

Linux Networking ExplainedThomas Graf

Cilium - BPF & XDP for containersThomas Graf

Cilium - Container Networking with BPF & XDPThomas Graf

SDN & NFV Introduction - Open Source Data Center NetworkingThomas Graf

The linux networking architecturehugo lu

OpenvSwitch Deep Diverajdeep

The 100 - {dive} : eventIRT b-com

Red Hat demo of OpenStack and ODL at ODL summit 2016 RedHatTelco

Why is PHP AwesomeJeremy Coates

Pipework: Software-Defined Network for Containers and DockerJérôme Petazzoni

Netfilter: Making large iptables rulesets scalebrouer

CETH for XDP [Linux Meetup Santa Clara | July 2016] IO Visor Project

Testing with CodeceptionJeremy Coates

進階嵌入式作業系統設計與實做 (2015 年秋季 ) 課程說明National Cheng Kung University

Mysql Explain ExplainedJeremy Coates

2016 年春季嵌入式作業系統課程說明National Cheng Kung University

Interpreter, Compiler, JIT from scratchNational Cheng Kung University

Making Linux do Hard Real-timeNational Cheng Kung University

Similar to LinuxCon 2015 Stateful NAT with OVS (20)

Scaling OpenStack Networking Beyond 4000 Nodes with Dragonflow - Eshed Gal-Or...Cloud Native Day Tel Aviv

As OpenStack matures, more users move from “dipping a toe” to deploying at large scale, with 1000's of nodes. OpenStack networking has long been a limiting factor in scaling beyond a few hundreds of nodes, forcing users to turn to cell splitting, or to complete offloading of the networking to the underlay systems and forfeit the overlay network altogether. Dragonflow is a fully distributed, open source, SDN implementation of Neutron, that handles large scale deployments without splitting to cells. In testing we've conducted, we were able to scale to 4000+ controllers (each controller is typically deployed on a compute node), while maintaining the same performance we had on a small 30 node environment.

Osnug meetup-tungsten fabric - overview.pptxM.Qasim Arham

Ovn vancouverMason Mei

OVN is an open source virtual network solution for Open vSwitch that provides logical L2 and L3 networking, including logical switches, routers, security groups, and multiple tunneling protocols. It is designed to scale to thousands of hypervisors and VMs, improve performance over existing plugins, and integrate with OpenStack and other cloud management systems through its databases and daemons. OVN aims to become the default virtual network solution in OpenStack Neutron by replacing the existing OVS plugin.

Dragonflow 01 2016 TLV meetup Eran Gampel

This document summarizes Dragonflow, an OpenStack Neutron plugin that implements a distributed SDN controller. Some key points: - Dragonflow provides a full implementation of the Neutron API and acts as a lightweight distributed SDN controller using a pluggable database. - It aims to provide advanced networking services like security groups, load balancing, and DHCP in an efficient, scalable way. - As an integral part of OpenStack, it is fully open source and designed for performance, scalability, and low latency. Its distributed control plane can sync policies across compute nodes.

OpenStack NetworkingIlya Shakhat

Stacks and Layers: Integrating P4, C, OVS and OpenStackOpen-NFP

This document discusses integrating programmable packet processing (P4), traditional software (C), and hardware acceleration using Agilio SmartNICs with OpenStack networking. It reviews traditional OpenStack networking options and their performance issues. It then discusses how P4, C extensions, and SmartNICs can provide flexible, high-performance networking by offloading or extending the OpenStack networking datapaths like OVS and Contrail vRouter. Examples are provided of running P4/C firmware on the SmartNIC to implement a virtual switch or extending existing software. Integration with OpenStack and implications are discussed throughout.

OpenStack Neutron Dragonflow l3 SDNmeetupEran Gampel

OpenFlow tutorialopenflow

The document discusses software-defined networking (SDN) and OpenFlow, including: 1) OpenFlow allows the control logic to be separated from the forwarding hardware by defining an open interface between the two. This enables more flexible and programmable networks. 2) OpenFlow works by defining flows that match packets and actions that are applied to the matched packets. The flows are populated and managed by an external controller through the OpenFlow protocol. 3) OpenFlow is being deployed in over 100 organizations and is enabling network innovation through its programmable and customizable nature.

Midokura OpenStack Meetup TaipeiDan Mihai Dumitriu

The document provides an overview of network virtualization requirements and the evolution of network virtualization in OpenStack. It discusses early approaches using VLANs and OpenFlow that had limitations and outlines how network overlays using encapsulation and tunneling address these by providing scalable, isolated tenant networks decoupled from physical network hardware. It then focuses on OpenStack Neutron and how it has evolved from Nova networking to support network virtualization using plugins like Midokura that provide distributed virtual network functions without relying on physical devices.

rtnetlinkTaku Fukushima

OpenDaylight Netvirt and Neutron - Mike Kolesnik, Josh Hershberg - OpenStack ...Cloud Native Day Tel Aviv

The document provides an overview and architecture of OpenDaylight Netvirt and its integration with Neutron. It discusses the Neutron/OpenDaylight architectural overview, the new networking_odl v2 architecture and features, and does a deep dive into the OpenDaylight Netvirt networking components and pipeline. It covers topics like external network configuration, the port creation sequence, DHCP ping response, and the OpenDaylight Netvirt service pipeline.

Using Agilio SmartNICs for OpenStack Networking AccelerationNetronome

[OpenStack Day in Korea 2015] Track 3-6 - Archiectural Overview of the Open S...OpenStack Korea Community

OpenFlow TutorialJa-seop Kwak

OpenFlow/Software-defined Networking aims to open up the network infrastructure through a "software-defined networking" approach. It proposes using simple packet forwarding hardware with an open interface and a network operating system that provides a well-defined open API. This allows multiple network operating systems or versions to run over the same underlying hardware, similar to how virtualization allows multiple operating systems to run on the same computer hardware. OpenFlow specifies the open interface and protocol to enable this new paradigm of network virtualization and programmability.

Quantum - Virtual networks for Openstacksalv_orlando

neutron_icehouse_updateAkihiro Motoki

OpenStack Networking and AutomationAdam Johnson

- OpenStack provides network virtualization and automation capabilities through projects like Neutron, Heat, and plugins like Midonet. - Neutron evolved networking in OpenStack to allow pluggable networking models beyond the initial Nova networking. It supports overlay technologies and network automation. - Heat allows you to define infrastructure like servers, networks, and their relationships in templates that can be deployed through the OpenStack API. This provides automation of virtual network deployment. - Plugins like Midonet provide distributed virtual networking models to improve scalability and performance over overlay approaches like OVS. They also allow automation of physical network configuration.

The Challenges of SDN/OpenFlow in an Operational and Large-scale NetworkOpen Networking Summits

Jun Bi Professor & Director Tsinghua University Outline • Intra-AS (campus level) IPv6 source address validation using OpenFlow (with extension) – Good for introducing new IP services to network • Planning next step if we run SDN as a common infrastructure for new services and architectures – Some personal viewpoints and thoughts on design challenges – Forwarding abstraction for Post-IP architectures – Control abstraction for scalable NOS and programmable/manageable virtualization platform – Inter-AS policies negotiation abstraction ONS2015: http://bit.ly/ons2015sd ONS Inspire! Webinars: http://bit.ly/oiw-sd Watch the talk (video) on ONS Content Archives: http://bit.ly/ons-archives-sd

Openstack Networking Internals - first partlilliput12

Network Virtualization & Software-defined NetworkingDigicomp Academy AG

This document introduces software defined networking (SDN) and network functions virtualization (NFV) concepts. It discusses challenges with traditional networking and how SDN and NFV address these by decoupling the control and data planes, making the network programmable through APIs, and virtualizing network functions. It then provides examples of open source SDN platforms like OpenDaylight, Open vSwitch, and OpenStack that enable building virtual networks and service chains.

Scaling OpenStack Networking Beyond 4000 Nodes with Dragonflow - Eshed Gal-Or...Cloud Native Day Tel Aviv

Osnug meetup-tungsten fabric - overview.pptxM.Qasim Arham

Ovn vancouverMason Mei

Dragonflow 01 2016 TLV meetup Eran Gampel

OpenStack NetworkingIlya Shakhat

Stacks and Layers: Integrating P4, C, OVS and OpenStackOpen-NFP

OpenStack Neutron Dragonflow l3 SDNmeetupEran Gampel

OpenFlow tutorialopenflow

Midokura OpenStack Meetup TaipeiDan Mihai Dumitriu

rtnetlinkTaku Fukushima

OpenDaylight Netvirt and Neutron - Mike Kolesnik, Josh Hershberg - OpenStack ...Cloud Native Day Tel Aviv

Using Agilio SmartNICs for OpenStack Networking AccelerationNetronome

[OpenStack Day in Korea 2015] Track 3-6 - Archiectural Overview of the Open S...OpenStack Korea Community

OpenFlow TutorialJa-seop Kwak

Quantum - Virtual networks for Openstacksalv_orlando

neutron_icehouse_updateAkihiro Motoki

OpenStack Networking and AutomationAdam Johnson

The Challenges of SDN/OpenFlow in an Operational and Large-scale NetworkOpen Networking Summits

Openstack Networking Internals - first partlilliput12

Network Virtualization & Software-defined NetworkingDigicomp Academy AG

Recently uploaded (20)

Cybersecurity Identity and Access Solutions using Azure ADVICTOR MAESTRE RAMIREZ

#StandardsGoals for 2025: Standards & certification roundup - Tech Forum 2025BookNet Canada

Book industry standards are evolving rapidly. In the first part of this session, we’ll share an overview of key developments from 2024 and the early months of 2025. Then, BookNet’s resident standards expert, Tom Richardson, and CEO, Lauren Stewart, have a forward-looking conversation about what’s next. Link to recording, transcript, and accompanying resource: https://bnctechforum.ca/sessions/standardsgoals-for-2025-standards-certification-roundup/ Presented by BookNet Canada on May 6, 2025 with support from the Department of Canadian Heritage.

AI Changes Everything – Talk at Cardiff Metropolitan University, 29th April 2...Alan Dix

Talk at the final event of Data Fusion Dynamics: A Collaborative UK-Saudi Initiative in Cybersecurity and Artificial Intelligence funded by the British Council UK-Saudi Challenge Fund 2024, Cardiff Metropolitan University, 29th April 2025 https://alandix.com/academic/talks/CMet2025-AI-Changes-Everything/ Is AI just another technology, or does it fundamentally change the way we live and think? Every technology has a direct impact with micro-ethical consequences, some good, some bad. However more profound are the ways in which some technologies reshape the very fabric of society with macro-ethical impacts. The invention of the stirrup revolutionised mounted combat, but as a side effect gave rise to the feudal system, which still shapes politics today. The internal combustion engine offers personal freedom and creates pollution, but has also transformed the nature of urban planning and international trade. When we look at AI the micro-ethical issues, such as bias, are most obvious, but the macro-ethical challenges may be greater. At a micro-ethical level AI has the potential to deepen social, ethnic and gender bias, issues I have warned about since the early 1990s! It is also being used increasingly on the battlefield. However, it also offers amazing opportunities in health and educations, as the recent Nobel prizes for the developers of AlphaFold illustrate. More radically, the need to encode ethics acts as a mirror to surface essential ethical problems and conflicts. At the macro-ethical level, by the early 2000s digital technology had already begun to undermine sovereignty (e.g. gambling), market economics (through network effects and emergent monopolies), and the very meaning of money. Modern AI is the child of big data, big computation and ultimately big business, intensifying the inherent tendency of digital technology to concentrate power. AI is already unravelling the fundamentals of the social, political and economic world around us, but this is a world that needs radical reimagining to overcome the global environmental and human challenges that confront us. Our challenge is whether to let the threads fall as they may, or to use them to weave a better future.

Linux Professional Institute LPIC-1 Exam.pdfRHCSA Guru

TrsLabs - Fintech Product & Business ConsultingTrs Labs

Hybrid Growth Mandate Model with TrsLabs Strategic Investments, Inorganic Growth, Business Model Pivoting are critical activities that business don't do/change everyday. In cases like this, it may benefit your business to choose a temporary external consultant. An unbiased plan driven by clearcut deliverables, market dynamics and without the influence of your internal office equations empower business leaders to make right choices. Getting things done within a budget within a timeframe is key to Growing Business - No matter whether you are a start-up or a big company Talk to us & Unlock the competitive advantage

Role of Data Annotation Services in AI-Powered ManufacturingAndrew Leo

ThousandEyes Partner Innovation Updates for May 2025ThousandEyes

The Evolution of Meme Coins A New Era for Digital Currency ppt.pdfAbi john

Enhancing ICU Intelligence: How Our Functional Testing Enabled a Healthcare I...Impelsys Inc.

Technology Trends in 2025: AI and Big Data AnalyticsInData Labs

At InData Labs, we have been keeping an ear to the ground, looking out for AI-enabled digital transformation trends coming our way in 2025. Our report will provide a look into the technology landscape of the future, including: -Artificial Intelligence Market Overview -Strategies for AI Adoption in 2025 -Anticipated drivers of AI adoption and transformative technologies -Benefits of AI and Big data for your business -Tips on how to prepare your business for innovation -AI and data privacy: Strategies for securing data privacy in AI models, etc. Download your free copy nowand implement the key findings to improve your business.

SAP Modernization: Maximizing the Value of Your SAP S/4HANA Migration.pdfPrecisely

Big Data Analytics Quick Research Guide by Arthur MorganArthur Morgan

This is a Quick Research Guide (QRG). QRGs include the following: - A brief, high-level overview of the QRG topic. - A milestone timeline for the QRG topic. - Links to various free online resource materials to provide a deeper dive into the QRG topic. - Conclusion and a recommendation for at least two books available in the SJPL system on the QRG topic. QRGs planned for the series: - Artificial Intelligence QRG - Quantum Computing QRG - Big Data Analytics QRG - Spacecraft Guidance, Navigation & Control QRG (coming 2026) - UK Home Computing & The Birth of ARM QRG (coming 2027) Any questions or comments? - Please contact Arthur Morgan at [email protected]. 100% human made.

Andrew Marnell: Transforming Business Strategy Through Data-Driven InsightsAndrew Marnell

AI and Data Privacy in 2025: Global TrendsInData Labs

In this infographic, we explore how businesses can implement effective governance frameworks to address AI data privacy. Understanding it is crucial for developing effective strategies that ensure compliance, safeguard customer trust, and leverage AI responsibly. Equip yourself with insights that can drive informed decision-making and position your organization for success in the future of data privacy. This infographic contains: -AI and data privacy: Key findings -Statistics on AI data privacy in the today’s world -Tips on how to overcome data privacy challenges -Benefits of AI data security investments. Keep up-to-date on how AI is reshaping privacy standards and what this entails for both individuals and organizations.

Into The Box Conference Keynote Day 1 (ITB2025)Ortus Solutions, Corp

Linux Support for SMARC: How Toradex Empowers Embedded DevelopersToradex

Toradex brings robust Linux support to SMARC (Smart Mobility Architecture), ensuring high performance and long-term reliability for embedded applications. Here’s how: • Optimized Torizon OS & Yocto Support – Toradex provides Torizon OS, a Debian-based easy-to-use platform, and Yocto BSPs for customized Linux images on SMARC modules. • Seamless Integration with i.MX 8M Plus and i.MX 95 – Toradex SMARC solutions leverage NXP’s i.MX 8 M Plus and i.MX 95 SoCs, delivering power efficiency and AI-ready performance. • Secure and Reliable – With Secure Boot, over-the-air (OTA) updates, and LTS kernel support, Toradex ensures industrial-grade security and longevity. • Containerized Workflows for AI & IoT – Support for Docker, ROS, and real-time Linux enables scalable AI, ML, and IoT applications. • Strong Ecosystem & Developer Support – Toradex offers comprehensive documentation, developer tools, and dedicated support, accelerating time-to-market. With Toradex’s Linux support for SMARC, developers get a scalable, secure, and high-performance solution for industrial, medical, and AI-driven applications. Do you have a specific project or application in mind where you're considering SMARC? We can help with Free Compatibility Check and help you with quick time-to-market For more information: https://www.toradex.com/computer-on-modules/smarc-arm-family

Complete Guide to Advanced Logistics Management Software in Riyadh.pdfSoftware Company

Explore the benefits and features of advanced logistics management software for businesses in Riyadh. This guide delves into the latest technologies, from real-time tracking and route optimization to warehouse management and inventory control, helping businesses streamline their logistics operations and reduce costs. Learn how implementing the right software solution can enhance efficiency, improve customer satisfaction, and provide a competitive edge in the growing logistics sector of Riyadh.

Procurement Insights Cost To Value Guide.pptxJon Hansen

tecnologias de las primeras civilizaciones.pdffjgm517

Special Meetup Edition - TDX Bengaluru Meetup #52.pptxshyamraj55