A scalable multithreaded L7-filter design for multi-core servers

Abstract

L7-filter is a significant component in Linux's QoS framework that classifies network traffic based on application layer data. It enables subsequent distribution of network resources in respect to the priority of applications. Considerable research has been reported to deploy multicore architectures for computationally intensive applications. Unfortunately, the proliferation of multi-core architectures has not helped fast packet processing due to: 1) the lack of efficient parallelism in legacy network programs, and 2) the non-trivial configuration for scalable utilization on multi-core servers.In this paper, we propose a highly scalable parallelized L7-filter system architecture with affinity-based scheduling on a multi-core server. We start with an analytical study of the system architecture based on an offline design. Similar to Receive Side Scaling (RSS) in the NIC, we develop a model to explore the connection level parallelism in L7-filter and propose an affinity-based scheduler to optimize system scalability. Performance results show that our optimized L7-filter has superior scalability over the naive multithreaded version. It improves system performance by about 50% when all the cores are deployed.

Protocol misidentification made easy with format-transforming encryption

“…Performance and scalability of regex-based traffic classification has been extensively studied [4,18,44]. Alternative protocol identification strategies that have been explored include using packet sizes and timings [6,51], the types and number connections initiated by a host (its "social behavior") [23,26], and various machine learning techniques [33,34,55].…”

High performance Deep Packet Inspection on multi-core platform

“…The new Affinity-based Scheduling enabled architecture of L7-Filter is shown in Figure 5. The cache performance of a multi-threaded L7-filter running on a kernel incorporating Affinitybased Scheduling has been evaluated by Guo [5] and is shown in Figure 6. …”

Towards High-Performance Network Application Identification With Aggregate-Flow Cache

“…Payload-based methods are accurate, but they consume a lot of computation power and become bottleneck when hardware resources are limited. Guo et al [9] presents that the throughput of original L7-filter is around 200Mbps on an latest Intel Xeon platform. Although the throughput of 8-thread parallel version reaches 1.2Gbps, it is far below the wire-speed of modern access networks (e.g.…”