Surachai CHITPINITYON Kasom KOHT-ARSA Surasak SANGUANPONG Anan PHONPHOEM Pirawat WATANAPONGSE Chalermpol CHUPAMPUN Office of Computer Services Kasetsart University Design and Implementation of Large Scale URL Filtering APAN, Xian, Network Security, 29 th August 2007 This work is partially supported by Commission of Higher Education (CHE), UniNET, Thailand

2 Network Operation Center Kasetsart University Office of Computer Services Agenda Why Need URL Filtering? Filtering Techniques TCP Revisited Proposed Solution Performance Facts Current Deployment Scalability Planning for 10Gbps

3 Network Operation Center Kasetsart University Office of Computer Services Agenda

4 Network Operation Center Kasetsart University Office of Computer Services Why Need URL Filtering? Access Policy Enforcement Parental Control Other restricted website by Policy Suspected Harmful Website (on-demand filtering) Spyware, Phishing Embedded Scripting Websites intend to attack OS/Software Vulnerabilities

5 Network Operation Center Kasetsart University Office of Computer Services Agenda

6 Network Operation Center Kasetsart University Office of Computer Services Gateway Filtering Engine Client Internet Pass-Through Web Filtering Traffics must pass through the filtering engine (Firewall, Proxy, Application Gateway) Create a queue of processing with delay Delay is depend on traffic volume and machine performance ? ? Allow Block Unknown 4

7 Network Operation Center Kasetsart University Office of Computer Services Pass-by Web Filtering Traffics are captured and passed by without queuing Zero delay, independent from traffic volume Ease of Installation (No Traffic Interruption) Non Blocking Traffic Stream No Single Point of Failure Scalable Gateway Filtering Engine Client Internet 3 ? ? 12 2

8 Network Operation Center Kasetsart University Office of Computer Services Agenda

9 Network Operation Center Kasetsart University Office of Computer Services TCP Connection Establishment & Data Transfer SYN J SYN K, ACK J+1 ACK K+1SYN_SENT ESTABLISED SYN_RCVD ESTABLISED Data (request) Data (reply) Client Server

10 Network Operation Center Kasetsart University Office of Computer Services TCP Connection Termination FIN L ACK L+1CLOSE_WAIT FIN_WAIT_1 FIN_WAIT_2 Client Server LAST_ACK FIN M ACK M+1 TIME_WAIT CLOSED

11 Network Operation Center Kasetsart University Office of Computer ServicesFiltering TCP Session Hijacking SYN J SYN K, ACK J+1 ACK K+1 FIN L Client Server Data (request) Data (reply) Packet will be ignored Faked FIN by Filtering Engine

12 Network Operation Center Kasetsart University Office of Computer Services Agenda

13 Network Operation Center Kasetsart University Office of Computer Services Proposed Solution Pass by method incorporated with 2 techniques Session Hijacking Session Hijacking Fast Sequence Number Interception Fast Sequence Number Interception Keywords Capturing in Application Request Packet Keywords Capturing in Application Request Packet URL Processing Designed to URL Processing Designed to Handle Hundred Million of URLs list Handle Hundred Million of URLs list Very fast access to URLs repository Very fast access to URLs repository

14 Network Operation Center Kasetsart University Office of Computer Services Session Hijacking FIN L Client Server Filtering Data (request) Data (reply) Successful filtering ACK L+1 Faked FIN FIN Mignored Unsuccessful filtering ACK M+1 FIN L Faked FIN

15 Network Operation Center Kasetsart University Office of Computer Services GET 3 Keyword Capturing Gateway Filtering Engine Client Internet GET/PUT/POST 1 GET search ? ? Matching 5 FIN 2 GET 4 FIN Black Lists 2 GET

16 Network Operation Center Kasetsart University Office of Computer Services URL Management Technique Key design URL Compression Techniques In-Memory Balanced Tree of URLs Utilize KSpider s Core Architecture (URL Manager Module) Benefits 69% Averaged Compression Ratio of URLs Length (currently supported Max 268 Millions URLs List under 8 GB RAM) Almost Linear Access Speed (10 microseconds by averaged

17 Network Operation Center Kasetsart University Office of Computer Services URL Buffer Queue URL Buffer Queue Scheduler URL Manager URL Storage Manager URL Storage Manager On Disk Parallel DNS Parallel DNS In-memory Storage KSpiders Architecture URL Filter Data Streamer URL Processor URL Extractor URL Buffer Queue URL Buffer Queue Scheduler Communicator Cluster Communicator Cluster Communicator Data Collector URL Buffer Queue URL Buffer Queue Storage Manager Data Compressor Data Decompressor HTTP Data Collector HTTP Data Collector Stats Collector Online indexer Other processing To Communicator Storage

18 Network Operation Center Kasetsart University Office of Computer Services URL Compression Technique Prefix Balance Search Tree Webscreen List 0http://

19 Network Operation Center Kasetsart University Office of Computer Services Agenda

20 Network Operation Center Kasetsart University Office of Computer Services Performance Hijack Activation under 0.6 msec Test Record 268 Million URLs with 8 GB Avg. Search Time 10 µsec (350 µsec MAX with 268 Million URLs) Memory Requirement 34M URL/GB Performance collected under Dell 2900, Intel Xeon 5160(3Ghz) 69% compression ratio with average 26.5 bytes per URL

21 Network Operation Center Kasetsart University Office of Computer Services Agenda

22 Network Operation Center Kasetsart University Office of Computer Services Reference Site 3 Gbps2 Gbps EtherChannel 2 Gbps Ethernet 1 Gbps CPU : 2xDual Core Opteron 2.4 Ghz RAM : 8 GB HD : SAS 146 GB WebScreen Agent Multiple Links/Interfaces Operations since December 2005 Inter. GW CAT Telecom 8 gigabit links span to 8 gigabit interfaces in 4 machine

23 Network Operation Center Kasetsart University Office of Computer Services Collected Statistics Avg. 110 request/s Dropping rate (9.5 M per day) Peak 250 request/s Dropping rate 4.6 Gbps aggregated traffic 1.6 M packet/s incoming packets 64 K packet/s http request packets

24 Network Operation Center Kasetsart University Office of Computer Services Agenda

25 Network Operation Center Kasetsart University Office of Computer Services Scalability Planning for 10Gbps Solutions for 10 Gbps Link Deploy Traffic Distribution Device (1x10 Gbps to 10x1 Gbps) Currently on the test of GigaVUE GigaVUE1 LAN Mirror port THAISARNUNINET GigaVUE2 Typical servers can handle up to 800 Mbps bit rate per 1 Gbps interface 1G 10G 1G 10G

26 Network Operation Center Kasetsart University Office of Computer Services Q&A

27 Network Operation Center Kasetsart University Office of Computer Services Thank You