An effective packet processing abstraction that leverages software or hardware acceleration techniques can simplify the implementation of high-performance virtual network functions. In this paper, we explore the suitability of SDN switches' stateful forwarding abstractions to model accelerated functions in both software and hardware accelerators, such as optimized software switches and FPGA-based NICs. In particular, we select an Extended Finite State Machine abstraction and demonstrate its suitability by implementing the Linux's iptables interface. By doing so, we provide the acceleration of functions such as stateful firewalls, load balancers and dynamic NATs. We find that supporting a flow-level programming consistency model is an important feature of a programming abstraction in this context. Furthermore, we demonstrate that such a model simplifies the scaling of the system when implemented in software, enabling efficient multi-core processing without harming state consistency.
. An extensive comparison of software accelerated capturing techniques can be found in @cite_0 @cite_42 @cite_1 . Relevant software accelerated engines are PF @cite_9 , PF ZC (Zero Copy) @cite_52 , Netmap @cite_21 , DPDK @cite_25 and PFQ @cite_32 . PF ZC, Netmap and DPDK bypass the Operating System by memory mapping the ring descriptors of NICs at user space, allowing even a single CPU to receive 64 bytes long packets up to full 10 Gbps line speed. In addition, DPDK adds a set of libraries for fast packet processing on multicore architectures for Linux. Netmap and DPDK have been successfully used in accelerating soft switch as in the case of the VALE @cite_24 switch and mSwitch @cite_49 (netmap) and CuckooSwitch @cite_60 and DPDK vSwitch @cite_12 (DPDK). Netmap was also used to accelerate packet forwarding in Click @cite_6 . PFQ, instead, relies on vanilla device drivers and leverages different levels of parallelism to accelerate packet I O. In addition, PFQ is equipped with a native functional language to program in--kernel early stage packet processing @cite_3 .
@cite_60 @cite_9 @cite_42 @cite_1 @cite_52 @cite_21 @cite_32 @cite_0 @cite_24 @cite_6 @cite_3 @cite_49 @cite_25 @cite_12
1989728020 1496406348 2044119008 1633306738 2106061258 2146314716 2032228686 2104367435 2013342629
Several emerging network trends and new architectural ideas are placing increasing demand on forwarding table sizes. From massive-scale datacenter networks running millions of virtual machines to flow-based software-defined networking, many intriguing design options require FIBs that can scale well beyond the thousands or tens of thousands possible using today's commodity switching chips. This paper presents CuckooSwitch, a software-based Ethernet switch design built around a memory-efficient, high-performance, and highly-concurrent hash table for compact and fast FIB lookup. We show that CuckooSwitch can process 92.22 million minimum-sized packets per second on a commodity server equipped with eight 10 Gbps Ethernet interfaces while maintaining a forwarding table of one billion forwarding entries. This rate is the maximum packets per second achievable across the underlying hardware's PCI buses. Users' demands have dramatically increased due to widespread availability of broadband access and new Internet avenues for accessing, sharing and working with information. In response, operators have upgraded their infrastructures to survive in a market as mature as the current Internet. This has meant that most network processing tasks (e.g., routing, anomaly detection, monitoring) must deal with challenging rates, challenges traditionally accomplished by specialized hardware—e.g., FPGA. However, such approaches lack either flexibility or extensibility—or both. As an alternative, the research community has proposed the utilization of commodity hardware providing flexible and extensible cost-aware solutions, thus entailing lower operational and capital expenditure investments. In this scenario, we explain how the arrival of commodity packet engines has revolutionized the development of traffic processing tasks. Thanks to the optimization of both NIC drivers and standard network stacks and by exploiting concepts such as parallelism and memory affinity, impressive packet capture rates can be achieved in hardware valued at a few thousand dollars. This tutorial explains the foundation of this new paradigm, i.e., the knowledge required to capture packets at multi-Gb s rates on commodity hardware. Furthermore, we thoroughly explain and empirically compare current proposals, and importantly explain how apply such proposals with a number of code examples. Finally, we review successful use cases of applications developed over these novel engines. Network stacks currently implemented in operating systems can no longer cope with the packet rates offered by 10 Gbit Ethernet. Thus, frameworks were developed claiming to offer a faster alternative for this demand. These frameworks enable arbitrary packet processing systems to be built from commodity hardware handling a traffic rate of several 10 Gbit interfaces, entering a domain previously only available to custom-built hardware. In this paper, we survey various frameworks for high-performance packet IO. We analyze the performance of the most prominent frameworks based on representative measurements in packet forwarding scenarios. Therefore, we quantify the effects of caching and look at the tradeoff between throughput and latency. Moreover, we introduce a model to estimate and assess the performance of these packet processing frameworks. Capturing network traffic with commodity hardware has become a feasible task: Advances in hardware as well as soft- ware have boosted off-the-shelf hardware to performance levels that some years ago were the domain of expensive special-purpose hardware. However, the capturing hardware still needs to be driven by a well-performing software stack in order to minimise or avoid packet loss. Improving the capturing stack of Linux and FreeBSD has been an extensively covered research topic in the past years. Although the majority of the proposed enhancements have been backed by evaluations, these have mostly been conducted on different hardware platforms and software versions, which renders a comparative assessment of the various approaches difficult, if not impossible. This paper summarises and evaluates the performance of current packet capturing solutions based on commodity hardware. We identify bottlenecks and pitfalls within the capturing stack of FreeBSD and Linux, and give explanations for the observed effects. Based on our experiments, we provide guidelines for users on how to configure their capturing systems for optimal performance and we also give hints on debugging bad performance. Furthermore, we propose improvements to the operating system's capturing processes that reduce packet loss, and evaluate their impact on capturing performance. The growing popularity of virtual machines is pushing the demand for high performance communication between them. Past solutions have seen the use of hardware assistance, in the form of "PCI passthrough" (dedicating parts of physical NICs to each virtual machine) and even bouncing traffic through physical switches to handle data forwarding and replication. In this paper we show that, with a proper design, very high speed communication between virtual machines can be achieved completely in software. Our architecture, called VALE, implements a Virtual Local Ethernet that can be used by virtual machines, such as QEMU, KVM and others, as well as by regular processes. VALE achieves a throughput of over 17 million packets per second (Mpps) between host processes, and over 2 Mpps between QEMU instances, without any hardware assistance. VALE is available for both FreeBSD and Linux hosts, and is implemented as a kernel module that extends our recently proposed netmap framework, and uses similar techniques to achieve high packet rates. Software packet forwarding has been used for a long time in general purpose operating systems. While interesting for prototyping or on slow links, it is not considered a viable solution at very high packet rates, where various sources of overhead (particularly, the packet I O mechanisms) get in the way of achieving good performance. Today's rapidly evolving network ecosystem, characterized by increasing traffic volumes, service heterogeneity and mutating cyber-threats, calls for new approaches to packet processing to address key issues such as scalability, flexibility, programmability and fast deployment. To this aim, this paper explores a new direction to packet processing by pushing forward functional programming principles in the definition of a ''software defined networking'' paradigm. This result is achieved by introducing PFQ-Lang, an extensible functional language which can be used to process, analyze and forward packets captured on modern multi-queue NICs (for example, it allows to quickly develop the early stage of monitoring applications). An implementation of PFQ-Lang, embedded into high level programming languages as an eDSL (embedded Domain Specific Language) is also presented. The proposed approach allows an easy development by leveraging the intuitive functional composition and, at the same time, allows to exploit multi-queue NICs and multi-core architectures to process high-speed network traffic. Experimental results are provided to prove that the presented implementation reaches line rate performance on a 10Gb line card. To demonstrate the effectiveness and expressiveness of PFQ-Lang, the paper also presents a few use-cases ranging from forwarding, firewalling and monitoring of real traffic. In recent years software network switches have regained eminence as a result of a number of growing trends, including the prominence of software-defined networks, as well as their use as back-ends to virtualization technologies, to name a few. Consequently, a number of high performance switches have been recently proposed in the literature, though none of these simultaneously provide (1) high packet rates, (2) high throughput, (3) low CPU usage, (4) high port density and (5) a flexible data plane. This is not by chance: these features conflict, and while achieving one or a few of them is (now) a solved problem, addressing the combination requires significant new design effort. In this paper we fill the gap by presenting mSwitch. To prove the flexibility and performance of our approach, we use mSwitch to build four distinct modules: a learning bridge consisting of 45 lines of code that outperforms FreeBSD's bridge by up to 8 times; an accelerated Open vSwitch module requiring small changes to the code and boosting performance by 2.6--3 times; a protocol demultiplexer for userspace protocol stacks; and a filtering module that can direct packets to virtualized middleboxes.