Demystifying the Performance of XDP BPF

Hohlfeld, Oliver; Krude, Johannes; Reelfs, Jens Helge; Rüth, Jan; Wehrle, Klaus

doi:10.1109/netsoft.2019.8806651

Cited by 24 publications

(10 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The user space datapath can filter out (drop) 29.8 Mpps (millions of packets per second) and forward 28 Mpps using a single CPU core, while the peak throughput, limited by the PCIe 3.0 x8 bandwidth [23] of our NIC's, saturates with four cores when forwarding packets at 74 Mpps and five cores when dropping them at 84 Mpps. The throughput with XDP is considerably lower: 11.5 Mpps when dropping and 7.3 Mpps when forwarding with a single core, which is consistent with other previous reports using hardware similar to ours [6], [24], [25]. XDP dropping throughput scaled up to 48.6 Mpps with eight cores, while forwarding saturates at only 19.1 Mpps with five cores, after which it degrades.…”

Section: Performance Evaluationsupporting

confidence: 90%

“…CPU cores. Similarly,[25] advocate eBPF/XDP for end host DDoS protection in combination with a SmartNIC that offloads some processing, reporting packet dropping rates of up to 14.88 Mpps, but lack a performance evaluation for a middlebox-type firewall use case. To take advantage of the NIC offloading, the workload has to be carefully partitioned between the (constrained) NIC hardware and theVOLUME 4, 2016 …”

mentioning

confidence: 99%

See 1 more Smart Citation

Surgical DDoS Filtering With Fast LPM

et al. 2022

View full text Add to dashboard Cite

Can software-based packet filters effectively dampen volumetric distributed denial-of-service (DDoS) streams in an era when 10 Gbps links are considered slow? The potential of longest prefix matching (LPM) for enforcing precise DDoS scrubbing policies seems to be overlooked in contemporary packet filtering datapaths, and in this paper, we argue that this should not be the case by showing that effective whitelist / blacklist LPM-based filtering can be performed with commodity hardware. A showcase datapath we propose can evaluate multiple queries in large separate LPM databases for each forwarded 64-byte packet, while sustaining 10 Gbps line rate on a single CPU core, with a healthy scaling potential due to its lockless architecture and small memory footprint of LPM structures. We demonstrated forwarding 64 million packets per second using only six CPU cores while performing independent lookups for each packet in three large LPM databases created by aggregating malicious IP addresses or by mapping different geolocation identifiers to IPv4 prefixes.

show abstract

Section: Performance Evaluationsupporting

confidence: 90%

mentioning

confidence: 99%

Surgical DDoS Filtering With Fast LPM

et al. 2022

View full text Add to dashboard Cite

show abstract

“…The Address Family eXpress Data Path (AF-XDP) [94] is a method for high-speed packet processing. AF-XDP aims to reduce the memory copying overhead through a common memory region for both application and device driver, effectively resulting in zero-copy processing.…”

Section: ) Operating Systems (Os)mentioning

confidence: 99%

Operating Systems and Hypervisors for Network Functions: A Survey of Enabling Technologies and Research Studies

et al. 2022

View full text Add to dashboard Cite

Scalable and flexible communication networks increasingly conduct the packet processing for Network Functions (NFs) in General Purpose Computing (GPC) platforms. The input/output (I/O)-intensive and latency-sensitive packet processing is challenging for the operating systems and hypervisors running on GPC platforms. This article surveys the existing enabling technologies and research studies on operating system and hypervisor aspects that directly influence the packet processing for NFs on GPC platforms. We organize this survey according to the main categories abstraction approach, memory access, and I/O strategy. We further categorize abstraction approach technologies and research studies into the categories operation systems, hypervisors, and containers. We partition the memory access category into the two subcategories of memory allocation and memory access, while we partition the I/O strategy category into the sub-categories I/O device virtualization and I/O device access. Our survey gives a comprehensive summary of the capabilities and limitations of the existing enabling technologies and researched approaches for abstraction, memory access, and I/O for NF packet processing. We outline critical future research directions for advancing NF packet processing on GPC platforms.

show abstract

“…SmartNICs like the Nvidia-Mellanox Connect-X 6 network adapter enable the execution of extended Berkely Packet Filters (eBPF) on the NIC itself using Express Data Path (XDP). Thus, eBPF provides a framework to enable offloading for a broad set of applications (Hohlfeld et al, 2019). eBPF/XDP-based offloading from the user-space is an interesting research area.…”

Section: Future Workmentioning

confidence: 99%

Securing InfiniBand Networks with the Bluefield-2 Data Processing Unit

Diamond`

Graham

Clark

2022

iccws

View full text Add to dashboard Cite

Interest in securing InfiniBand networks with encryption is growing. However, the performance benefit realized by InfiniBand’s use of Direct Memory Access (DMA) to bypass the kernel and avoid intervention from host Central Processing Units (CPUs) is at odds with IP datagram encryption techniques. Encryption forces data through the CPU before transmission and decryption, incurring multiple clock cycles. The Bluefield-2 Data Processing Unit (DPU) is Nvidia-Mellanox’s latest system on chip that combines a high-performance, programmable processor, network interface card (NIC), and flexible hardware accelerators. This research characterizes the Bluefield-2’s capability to accelerate IPsec encryption in hardware. Results show that the Bluefield-2’s hardware accelerators are capable of supporting a secure IPsec tunnel with a throughput of nearly 16 Gb/s. Offloading IPsec encryption operations to the hardware accelerators on the Bluefield-2 is a promising method for adding confidentiality, integrity, and authentication to InfiniBand networks.

show abstract

Demystifying the Performance of XDP BPF

Cited by 24 publications

References 9 publications

Surgical DDoS Filtering With Fast LPM

Surgical DDoS Filtering With Fast LPM

Operating Systems and Hypervisors for Network Functions: A Survey of Enabling Technologies and Research Studies

Securing InfiniBand Networks with the Bluefield-2 Data Processing Unit

Contact Info

Product

Resources

About