L3DGEWorld V1.0

Overview

L3DGEWorld is a plug-in modification to the Quake III Arena (Q3A) game engine. L3DGEWorld allows monitoring and control of a live network to take place from within a virtual world created by the Q3A game engine.

L3DGEWorld is the product of a research project aimed at simplifying two key network management tasks[1]:

• The identification of anomalous traffic patterns within IP networks, and
• The control of network elements (such as routers and firewalls) to block anomalous traffic.

L3DGEWorld currently creates a virtual world in which spinning objects represent the rate at which IP packets are heading towards particular, monitored IP addresses on your network. By using in-game techniques (in version 1.0 this involves 'shooting a gun at the spinning object') a network operator can initiate an ACL update to block undesired traffic. Our current implementation allows multiple participants to view and interact with the spinning network entities, and requires two participants to concurrently trigger any ACL updates.

L3DGEWorld will run on any platform to which Q3A has been ported, and does not require the client or server portions of Q3A to be recompiled.

Included in this release is greymatter, a FreeBSD-based application that monitors 'greynet' network traffic [2] and feeds real time information to L3DGEWorld. L3DGEWorld itself does not specifically require greymatter, and may be fed real time traffic information from other external sources.

Screenshots

Network overview.	Marking a greynet hosts to have an ACL Placed.
Collaborating with another user, while getting detailed information about a greynet host.

System Requirements

L3DGEWorld and it's demonstration scripts have been verified to run on FreeBSD 6.2 and Windows XP Platforms (with the addition of cygwin). At this stage greymatter has only been verified to run on FreeBSD.

Client Requirements:

• Full Version of Quake 3 Arena, updated to version 1.32
• L3DGEWorld V1.0 distribution
• Q3A capable computer

Server Requirements:

• Full Version of Quake 3 Arena, updated to version 1.32
• L3DGEWorld V1.0 distribution
• Q3A capable computer
• expect (http://expect.nist.gov/)
• BASH (Bourne Again SHell)

Q3A updates can be found at id software's ftp site

Documentation

Please see the files included in the tarball (available below) for further documentation.

Licensing

L3DGEWorld is copyright (C) 2007, the Centre for Advanced Internet Architectures, Swinburne University of Technology

L3DGEWorld is distributed under version 2 of the GNU General Public Licence.

Future Work

Planned features for future versions of L3DGEWorld include:

• Clients will be assigned differnet numbers of "points", so a higher level administrator may be able to place ACLs unaided.
• The number of "points" required to place ACLs for each Greynet Host will be configurable.
• Maps may be made up of multiple rooms, with a certian number of points required to enter certian rooms (preventing lower level adminstrators from viewing areas of the network).
• The remove ACL gun will become functional.
• Other input and output daemons will be developed allowing the monitoring and controlling of a larger range of devices.

Authors and Acknowledgments

• Support for the development of L3DGEWorld is provided in part by a grant from the Cisco University Research Program Fund at Community Foundation Silicon Valley. The URP project, titled "Anomalous traffic detection and collaborative network configuration using 3D multiplayer game engines", is led by Associate Professor Grenville Armitage (CAIA) and supported by Fred Baker (Cisco). This project has been made possible in part by a grant from the at Community Foundation Silicon Valley.
• L3DGEWorld V1.0 has been developed by Lucas Parry
• The Greymatter input daemon was developed by Warren Harrop.
• We have recieved a lot of valuable feedback and testing by Grenville Armitage.
• Thanks to Alex Shoolman, who's work on LTMON led into the start of L3DGEWorld.
• Thanks to Blazej Kot, author of Q3SRCVIS, who's code helped Lucas greatly in understanding the Q3A source.

References

1. W. Harrop, G. Armitage, "Real-Time Collaborative Network Monitoring and Control Using 3D Game Engines for Representation and Interaction," in VizSEC'06 Workshop on Visualization for Computer Security, Virginia, USA, October-November 2006.
2. W. Harrop, G. Armitage "Defining and Evaluating Greynets (Sparse Darknets)", IEEE 30th Conference on Local Computer Networks (LCN 2005) Sydney, Australia, 15-17 November, 2005.

Download

• Download L3DGEWorld V1.0 here (1.1MB)

Go back to the L3DGE project main page