Sylvain Baubeau

Graffiti is the graph engine of Skydive - an open source networking analysis tool. Graffiti was created from scratch to provide the features required by Skydive : distributed, replicated, store the whole history of the graph, allow subcribing to events on the graph using WebSocket and visualization.

Skydive (https://skydive.network) is an open source analysis tool. It collects information about an infrastructure topology - such as network interfaces, Linux bridges, network namespaces, containers, virtual machines, ... and store them into a graph database called Graffiti (https://github.com/skydive-project/skydive/tree/master/graffiti)

The graph is :

- distributed : some agents only have a portion of the graph
- replicated : for high availability and load distribution
- historical : every change on the graph is archived, allowing retrieval of the graph at any point in time or getting all the revisions of a set of nodes and edges during a period of time

A custom implementation of the Gremlin language is used to query the graph, with some additional steps to specify the time context of the query for instance.

In addition to the core engine, a WebSocket based user interface - based on D3JS - is available to visualize and interact with the graph.

This presentation will showcase a demo of Graffiti and try to advocate its use in your own project.

Skydive is an open source real-time network topology and protocols analyzer providing a comprehensive way of understanding what is happening in your network infrastructure.

Skydive is a toolbox to monitor, visualize and troubleshoot an infrastructure.

It first collects all the information about the physical and logical infrastructure : network interfaces, Linux and Openvswitch bridges, network namespaces, Docker/runc containers, Kubernetes objects, virtual machines and more. All these objects are stored into a graph to allow the operator to visualize and query the whole topology. On top of this, Skydive is able to inject, capture and analyze traffic at any point of this infrastructure - using various technics such as AFpacket, eBPF, DPDK or SFlow samples. This make possible use cases like :

• troobleshoot dropped packets

• get metrics and bandwidth about some specific traffic

• trigger alert on some abnormal traffic detection

• get latency on the whole path of a flow

• and a lot more...

Skydive is agnostic to any SDN, container orchestration engine or virtualization platform. That being said, Skydive has plugins for specific technologies such as Kubernetes/Istio, OpenStack, Openvswitch, Network Service Mesh, OpenContrail, VPP and more.

This presentation will present the architecture of Skydive and demonstrate some use cases through a demo.