There has been a lot of energy recently behind eBPF in the cloud-native space, with adoption rates increasing and use cases expanding over the past few years. eBPF appears to have moved firmly out of the early adopter stage and is now entering a more mainstream and accelerated path along its technology maturity curve.
MantisNet's Tawon CVF (Containerized Visibility Fabric) provides platform teams with full visibility into containerized environments, with a specific ability to address the visibility challenges facing 5G mobile network operators. Working closely with key partner (and leading telco platform and solution provider) Red Hat, MantisNet continues to prove how establishing real-time visibility solutions for 5G telco networks can be accomplished by leveraging solutions built on cloud-native principles.
With the arrival and increased ramp up of 5G Stand Alone (SA) mobile networks, telecommunications operators have rightfully earned a (very large) seat at the cloud-native table. After all, these are fully containerized networks we are talking about- without any VNF stepping stones left. Nothing gets more cloud-native than that.
However, there is a uniqueness to “telco cloud-native” that doesn’t necessarily exist across the board for all “generic cloud-native” companies. 5G telcos are not only tasked with embracing and deploying fully containerized
In part one of this blog series, we explored the reasons behind “why” messages may be a better path forward for 5G visibility strategies than simply relying on a traditional approach of “grabbing more packets”. The main motivator for overhauling visibility/observability strategies for stand alone (SA) 5G networks is that these networks are fundamentally different from previous generations’ telecommunications networks. These differences were broken down into the following challenges that the engineering team at MantisNet set out to address:
Around four years ago MantisNet’s engineering team set out to answer a question that seemed glaringly obvious, but consistently ignored by others in the visibility space- “How do monitoring solutions need to evolve to handle the changes that 5G bring?”
According to recent market data from GSMA Intelligence (www.gsmaintelligence.com/) the tipping point for the global transition to 5G applications has been reached. As a result, the roll-out of 5G deployments is poised to dramatically accelerate over the next three years. In confirmation of these predictions, we’ve also seen numerous recent announcements about the acceleration of coverage and the 5G subscriber growth from carriers and service providers around the world around (see AT&T, Vodafone, Telefonica, and Deutsche Telekom).
Introduction
In the security industry, visibility is everything. As the old adage goes, you can’t stop what you can’t see. This is why Palo Alto Networks created the Next Generation Firewall and why Mantisnet is seeing such incredible traction with its cloud-native tools in order to fully instrument control, management and dataplane messaging/traffic at the kernel level. When Palo Alto Networks was created, most firewalls were “stateful firewalls”, and policies were created based on a “5-tuple”, where the 5-tuple was the source and destination address and port, and the protocol (TCP or UDP). What happens though when you have multiple applications running on the same port? How do you stop bittorrent on port 443, but allow HTTPS traffic to legitimate web sites? Thus was born the Next Generation Firewall that could secure any application regardless of what port or protocol it was running on.
There are many aspects of 5G environments that are challenging for establishing visibility. The first example may be the most obvious- 5G is promising an extreme growth in the amount of data being generated. All forecasts for 5G environments indicate that there will be an explosive growth in data, full stop. Cutting edge smart use cases, the proliferation of IoT environments, and a growing reliance on mobile technology for communications and media consumption will all generate a massive amount of data that 5G networks will serve up and host. Given this incoming data storm, does it make sense moving forward with current visibility approaches? Current solutions largely center around the concept of “grab all packets”, or at the very least are "packet centric". Will this approach continue to be sufficient given the enormous amount of data within 5G?
Today’s cloud-native systems are built using containerized, distributed micro-services-based architectures. Accordingly, the Application Programming Interfaces (APIs) these systems utilize are the key to understanding the operations, status, and communications within those systems. Consequently, having deep API-Centric visibility is both critical and necessary for operations and security.
Taking a step back
When discussing the specific benefits and approaches of leveraging eBPF programs, it is very easy to head directly into a technical rabbit hole. The technology is very detailed and can be used for a wide variety of use cases. Consequently, conversations can quickly get wrapped around specifics while glossing over the fundamental elements of the technology. As is true with any newer technology, it is often helpful to level-set and take a step back to discuss the basics. This post will serve to do just that- provide a high level view into the fundamentals of an eBPF program, and more specifically, into an eBPF program being used for 5G SA visibility.
Tags: mantis, 5G, eBPF, cloud-native
