NFR Architecture |
NFR ArchitectureThe NFR architecture consists of a set of components, each designed to perform a specific activity. There are basically four main components to NFR:
The following figure illustrates the NFR architecture. A narrative of the process flow follows the diagram: Input Packet ReadingNFR begins its process when it receives a packet from the network. Those packets are read and then forwarded to the "Engine" (also referred to as nfrd) for filtering and reassembling. If the information was flagged as pertinent, based upon the filtering logic, it is recorded to a backend for storage or statistical processing. The Engine (nfrd)The Engine performs various tasks, such as tcp stream reassembly, but its primary purpose is to execute "N code" which is an interpreted programming language. N code performs various functions that are activated by the incoming data. The engine examines the data and decides what action to take. Packets are passed into the decision engine, where they are checked against a list of filters for evaluation. Filters are written in N-code, which is read into the engine, compiled, and preserved as byte-code instructions for fast execution. TCP traffic is applied against a reassembly table that preserves the state of each current TCP session. The state reassembly mechanism permits matching patterns or other events within the lifetime of a TCP stream, and keeps statistics pertaining to variance in the delivery of packets. These statistics are used to determine when the engine will stop watching a given connection for example, connections are not considered "closed" until a timeout has exceeded two standard deviations of the average packet arrival rate after a FIN packet. Certain types of broken packets can be detected, and users can access byte counts of retransmitted packets - duplication of traffic - which might indicate network problems. Backend ProcessorsDepending on the results of the evaluation, the data is then sent to the "backends" or backend processors which are components of NFR that record the data in files and allow queries of that data. NFR provides different types of backends, however you can write the backends to be simple or complex depending upon what data you are actually trying to extract. Currently, two types of backends are provided: histogram and list. Histogram maintains a columnar table of data, either totaling specific values in the columns or incrementing them. The list backend maintains chronological records. Because lists do not collapse and total data as the histogram does, lists data storage tends to be less space efficient. QueryAfter the data is recorded to disk by the backend, you can query it through the query backend or GUI. With the GUI, you can selectively view the data based on specific criteria as well as produce various styles of reports based on your particular needs. The query interface is a separate function that does not interfere with the recording of data. This minimizes any impact on performance if multiple users are querying the system while it is collecting data. You can query on specific field values and fields and indicate how you want the information to be presented. AlertingBased on the filtering decision, the NFR can send an "alert". An alert is a message that is sent to a user when some exceptional or noteworthy condition occurs. The alert originates in the part of the system that detects the condition, which sends the message to alertd. Alertd acts as a queuing and forwarding system. Each alert can be sent to the user in various formats. For example, you can chose to just log a routine message rather than sending it immediately. Important messages might be logged, sent as a fax, sent as a page, and so forth. Space ManagementAfter the traffic has been analyzed, it is then stored. Backends store data on disk. Disk usage is monitored and controlled by the Space Management system of NFR called "spaceman". As backends accumulate data, the Space Management system can archive or delete some of the data to keep a backend within a particular disk quota. This feature allows you to store as much data as required while giving you the option of viewing it immediately or storing it for future use. You decide how much data you want to store and where to store it. |
|