Exposing Inter-Virtual Machine Networking Traffic to External Applications Charles E
Total Page:16
File Type:pdf, Size:1020Kb
Air Force Institute of Technology AFIT Scholar Theses and Dissertations Student Graduate Works 3-24-2016 Exposing Inter-Virtual Machine Networking Traffic to External Applications Charles E. Byrd Follow this and additional works at: https://scholar.afit.edu/etd Part of the Computer Engineering Commons Recommended Citation Byrd, Charles E., "Exposing Inter-Virtual Machine Networking Traffico t External Applications" (2016). Theses and Dissertations. 290. https://scholar.afit.edu/etd/290 This Thesis is brought to you for free and open access by the Student Graduate Works at AFIT Scholar. It has been accepted for inclusion in Theses and Dissertations by an authorized administrator of AFIT Scholar. For more information, please contact [email protected]. EXPOSING INTER-VIRTUAL MACHINE NETWORKING TRAFFIC TO EXTERNAL APPLICATIONS THESIS Charles E. Byrd, CW3, USA AFIT-ENG-MS-16-M-006 DEPARTMENT OF THE AIR FORCE AIR UNIVERSITY AIR FORCE INSTITUTE OF TECHNOLOGY Wright-Patterson Air Force Base, Ohio DISTRIBUTION STATEMENT A: APPROVED FOR PUBLIC RELEASE; DISTRIBUTION UNLIMITED. The views expressed in this document are those of the author and do not reflect the official policy or position of the United States Air Force, the United States Department of Defense or the United States Government. This material is declared a work of the U.S. Government and is not subject to copyright protection in the United States. AFIT-ENG-MS-16-M-006 EXPOSING INTER-VIRTUAL MACHINE NETWORKING TRAFFIC TO EXTERNAL APPLICATIONS THESIS Presented to the Faculty Department of Electrical and Computer Engineering Graduate School of Engineering and Management Air Force Institute of Technology Air University Air Education and Training Command in Partial Fulfillment of the Requirements for the Degree of Master of Science in Cyber Operations Charles E. Byrd, B.S.C.I.S. CW3, USA March 2016 DISTRIBUTION STATEMENT A: APPROVED FOR PUBLIC RELEASE; DISTRIBUTION UNLIMITED. AFIT-ENG-MS-16-M-006 EXPOSING INTER-VIRTUAL MACHINE NETWORKING TRAFFIC TO EXTERNAL APPLICATIONS THESIS Charles E. Byrd, B.S.C.I.S. CW3, USA Committee Membership: Barry E. Mullins, Ph.D. Chair Timothy H. Lacey, Ph.D. Member Michael R. Grimaila Ph.D., CISM, CISSP Member AFIT-ENG-MS-16-M-006 Abstract Virtualization is a powerful and fast growing technology that is widely accepted throughout the computing industry. The Department of Defense has moved its focus to virtualization and looks to take advantage of virtualized hardware, software, and networks. Virtual environments provide many benefits but create both administra- tive and security challenges. The challenge of monitoring virtual networks is having visibility of inter-virtual machine (VM) traffic that is passed within a single virtual host. This thesis attempts to gain visibility and evaluate performance of inter-VM traffic in a virtual environment. Separate virtual networks are produced using VMWare ESXi and Citrix XenServer platforms. The networks are comprised of three virtual hosts containing a Domain Controller VM, a Dynamic Host Configuration Protocol server VM, two management VMs, and four testing VMs. Configuration of virtual hosts, VMs, and networking components are identical on each network for a consistent comparison. Transmission Control Protocol (TCP) and User Datagram Protocl (UDP) traffic is generated to test each network using custom batch files, Powershell scripts, and Python code. Results show standard virtual networks require additional resources (e.g., local Intrusion Detection System) and more hands-on administration for real-time traffic visibility than a virtual network using a distributed switch. Traffic visibility within a standard network is limited to using a local packet capture program such as pktcap-uw, tcpdump, or windump. However, distributed networks offer advanced options, such as port mirroring and NetFlow, that deliver higher visibility but come at a higher latency for both TCP and UDP inter-VM traffic. iv Acknowledgements I would like to extend my deepest appreciation to my committee for their guidance, direction, and education offered. Dr. Mullins, Dr. Lacey, and Dr. Grimaila are the consummate professionals that I am pleased to know and work alongside. I would also like to thank the rest of AFIT staff and faculty for the excellent education presented. The education and challenges offered far exceeds any other I have attended. The most important people I would like to thank are my wife and kids. The understanding and encouragement they give is why I can do what I do. Last but not least, I want thank my Lord, Jesus Christ, for his grace and mercy that allows me to be where I am today. v Table of Contents Page Abstract . iv Acknowledgements . .v List of Figures . ix List of Tables . xii List of Abbreviations . xiii I. Introduction . .1 1.1 Background . .1 1.2 Motivation . .2 1.3 Research Goals and Hypothesis. .2 1.4 Approach . .3 1.5 Assumptions and Limitations . .4 1.6 Contributions . .4 1.7 Thesis Overview. .4 II. Background and Related Research . .5 2.1 Virtualization . .5 2.1.1 Hypervisor . .6 2.1.2 Virtual Machine . .8 2.2 Virtual Networking . .9 2.2.1 Virtual Switches. .9 2.2.2 Virtual Traffic . 10 2.3 The Kusnetzky Group Model of Virtualization . 11 2.3.1 Access Virtualization . 12 2.3.2 Application Virtualization . 13 2.3.3 Processing Virtualization . 13 2.3.4 Network Virtualization . 14 2.3.5 Storage Virtualization . 14 2.3.6 Security for Virtual Environment . 15 2.3.7 Management of Virtual Environment . 15 2.4 Virtual Privileges . 16 2.4.1 Protection Rings . 16 2.4.2 Domains . 18 2.5 Virtualization Techniques . 19 2.5.1 Full Virtualization . 19 2.5.2 Paravirtualization . 20 2.5.3 Hardware Assisted Virtualization . 21 vi Page 2.6 Virtual Security . 22 2.7 Related Research . 24 2.7.1 Inter-VM Visibility in a Cloud Environment . 25 2.7.2 Communication-Aware Inter-VM Scheduling . 25 2.8 Summary . 26 III. Methodology . 28 3.1 Problem Definition . 28 3.2 Goals and Hypothesis . 29 3.3 Approach . 30 3.4 Experiment Factors . 31 3.4.1 Physical Infrastructure . 33 3.4.2 Physical Switch Configuration . 34 3.4.3 Hypervisor with Management Tools . 35 3.4.4 Virtual Machine Configuration . 36 3.4.5 VMWare ESXi Standard and Distributed Switch . 37 3.4.6 Citrix XenServer Standard and Distributed Switch .................................................. 39 3.5 Experiment Details . 41 3.5.1 Traffic Generation . 42 3.5.2 Traffic Capture . 43 3.5.3 Performance Data Collection . 46 3.5.4 Standard Configuration . 47 3.5.5 Distributed Configuration . 48 3.6 Summary . 49 IV. Results and Analysis . 50 4.1 Visibility Results and Analysis . 50 4.1.1 VMWare ESXi Standard Network . 51 4.1.2 Citrix XenServer Standard Network . 52 4.1.3 VMWare ESXi Distributed Network . 54 4.1.4 Citrix XenServer Distributed Network . 55 4.2 Performance Results and Analysis . 56 4.2.1 Performance Data . 56 4.2.2 Virtual Switch Comparison . 57.