Dynamic network monitoring of IoT devices

Details

Supervisors

Sadre, Ramin

Faculty

Ecole polytechnique de Louvain

Degree label

Master [120] en sciences informatiques

Abstract

Nowadays, networks of embedded devices are constantly growing in popularity. The Internet of Things is becoming omnipresent. From the private context with temperature monitoring or smart devices, to the industry where sensors need to exchange data over wireless network or even Bluetooth, connected objects have become part of our daily lives. However, monitoring those networks raises some issues because of its attributes such as the complexity of the topology or the low resource of its devices. In order to bring new solutions that would allow administrators to efficiently monitor their network, this thesis has explored the utilisation of eBPF which is a technology that allows gathering connection related statistics directly on the end-hosts. eBPF states for "extended Berkeley Packet Filter" which was created by Lawrence Berkeley Laboratory back in 1992. This filter located in the kernel had for purpose processing the packets in place without having to bear the cost of copying them in the user space. From now, this new version of BPF provides new features which give the user the opportunity to execute customized code in the kernel. In the context of this thesis, this technology allows to gather statistics directly at the source while minimizing the overhead. A proof of concept of this solution has been implemented and validated to demonstrate the possibilities and suggestions in making an efficient monitoring tool. Experiments show that eBPF doesn't need to be activated dynamically as it's costly for the CPU to reset the tool or attach kprobes that contains the user code. Instead, it could be used in background and activate the sending of data on request or when an event happens in the kernel. In order to use eBPF on embedded devices, there are currently a few possibilities that aren't easy to put in place or aren't really efficient for such small devices. Hopefully, eBPF community is still expanding, improving the already existing tools like BCC and implementing new ones like portable eBPF format (BTF) to make eBPF part of the next generation of monitoring tools.