add example workload (with syn attack)

[eranra]

The workload is based on GoogleCloudPlatform/microservices-demo
Syn attack is based on docker and an example from https://github.com/bilalcaliskan/syn-flood

[jotak]

is that something where you can leverage netobserv to spot the attack?
how would you demo that? (I'm interested if I can reuse that use-case in demo/talk :) )

[eranra]

is that something where you can leverage netobserv to spot the attack? how would you demo that? (I'm interested if I can reuse that use-case in demo/talk :) )

Maybe this syn attack traffic is not "seen" by OVS/N ... I need to check more

We can see in the namespace level a lot of traffic into the sample-workload namespace (as expected)

And then focus on the frontend-external pod we see a lot of traffic from unknown sources

This is exactly what we expect to see in such a scenario.

[eranra]

/retest

[eranra]

@jpinsonneau I see strange amount of packets (on the edges) when I change the view to show the number of packets::

I was expecting a very small amount. And BTW; I see the same in the table ... so something is not making sense here:

[jotak]

@eranra default payload length is 1400, it's consistent with the values that you have:
https://github.com/bilalcaliskan/syn-flood/blob/master/cmd/root.go#L24-L25
E.g. 98290400 / 67600 = 1454

(or you were expecting less packets, but why? isn't it the purpose to send as many packets as possible?)

[eranra]

@eranra default payload length is 1400, it's consistent with the values that you have: https://github.com/bilalcaliskan/syn-flood/blob/master/cmd/root.go#L24-L25 E.g. 98290400 / 67600 = 1454

(or you were expecting fewer packets, but why? isn't it the purpose to send as many packets as possible?)

I was expecting fewer packets (only one per flow with syn) ... it should be 1400 bytes total if I read the documentation correctly (and the code of the payload creation here https://github.com/bilalcaliskan/syn-flood/blob/ec6298dd2ffe52ea0f5d7eb62adc9ada5ac8d856/internal/raw/utils.go#L13 )))

We get a lot of packets per connection ... not what I expected

[jotak]

maybe with sampling = 1?

[jotak]

I tend to use make ocp-expose just to create grafana/loki routes. Can you split in two different targets then? (maybe ocp-expose and ocp-expose-all, similarly to the deploy-all that deploys more than just the infra ?

[eranra]

Fixed (@jotak please review again that this fits your needs )

[jotak]

lgtm!

[jotak]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jotak

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [jotak]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment