Data Plane Development Kit Research Articles

In‐network caching based NBA‐traffic offloading mechanism: A D2D communication mode

This letter studies the NBA (National Basketball Association)‐traffic offload mechanism based on in‐network caching and D2D (Device‐to‐Device) communication mode, where the router is enabled with the caching ability and the information exchange is based on the direct communication between two D2D groups. Meanwhile, the DPDK (Data Plane Development Kit) is used to do segmentation for the NBA‐video, which can guarantee that all segments have the same size in order to improve the caching efficiency; the clustering analysis based on maximal tree is adopted to divided into some users into several different D2D groups. Furthermore, for each D2D group, the forwarding ability is quantified based on degree centrality and available bandwidth, and it is used to select the group head. The experimental results show that the proposed novel NBA‐traffic offloading mechanism is feasible and efficient.

A novel video delivery mechanism for caching-enabled networks

The caching-enabled networks, especially Information-Centric Networking (ICN), have attracted much attention from some global research communities, and the corresponding achievements have been highlighted in the field of video delivery. This paper studies more effective video delivery mechanism in order to guarantee better network performance based on two conceptions, i.e., the intermediate caching of popular video segments and the light delivery of identity object. At first, we evaluate the popularity under the dynamic environment, including descending modelling, ascending modelling and period modelling. Then, we propose identity-based light video delivery mechanism; in particular, we introduce Data Plane Development Kit (DPDK) to ensure that all video segments have the same size and to accelerate video transmission by bypassing the kernel. Finally, the simulation experiments are made based on the real YouTube dataset over CERNET network topology, and the results demonstrate that the proposed video delivery mechanism outperforms two the-state-of-the-art mechanisms in terms of cache hit ratio, routing hop count, delivery delay and network load.

Anti-reconnaissance Model of Host Fingerprint Based on Virtual Node

Aiming at the problem of insufficient defense ability of fingerprint detection, the anti-reconnaissance model of host fingerprint based on virtual node is proposed. The model constructs periodically reconfigurable virtual nodes, dynamically camouflages the fingerprint information of the host to deceive the detector, and redirect attack traffic targeting virtual nodes to honeypots that can capture and analyze attack behavior. Honeypot, as an active defense technology, can effectively improve the model’s defense capabilities. This paper introduces probabilistic models for the defense model to provide a deeper understanding of the theoretical effect their parameters have for cybersecurity, which quantifies the impact of different parameters on the probability of attack success, such as the number of probes, number of honeypot mapping rules, the virtual node deception rate, the honeypot detection rate and allowable losses. Furthermore, our prototype system using Software Defined Network (SDN) and Data Plane Development Kit (DPDK) verifies the effectiveness of the model against reconnaissance.

Packet‐level‐based traffic aggregation to optimize NDN content delivery

SummaryIn recent years, named data networking (NDN) has been accepted as the most popular future paradigm and attracted much attention, of which the routing model contains interest forwarding and content delivery. However, interest forwarding is far from the bottleneck of routing optimization; instead, the study on content delivery can greatly promote routing performance. Although many proposals on content delivery have been investigated, they have not considered packet‐level caching and deep traffic aggregation, which goes against the performance optimization of content delivery. In this paper, we propose a packet‐level‐based traffic aggregation (PLTA) scheme to optimize NDN content delivery. At first, the packet format is devised, and data plane development kit (DPDK) is used to ensure same size for each packet. Then, the whole delivery scheme with traffic aggregation consideration is presented. The simulation is driven by the real YouTube dataset over Deltacom, NSFNET, and CERNET topologies, and the experimental results demonstrate that the proposed PLTA has better delivery performance than three baselines in terms of cache hit ratio, delivery delay, network load, and energy efficiency.

ONVM-5G: a framework for realization of 5G core in a box using DPDK

Software Defined Networking (SDN) and Network Functions Virtualization (NFV) are the two fundamental paradigms that introduce concealed flexibility in communication systems. 5G has adopted SDN/NFV to make Network Functions (NFs) as virtualized software modules which run on top of commodity hardware. 5G aims to expand its reach to various business verticals and serve diverse users using network slicing which creates multiple logical networks on top of a shared infrastructure. This paper proposes a novel OpenNetVM based 5G framework (ONVM-5G) which uses Data Plane Development Kit for the communication between the core NFs and thus, is a candidate solution for implementing 5G core (5GC) in a box. The proposed framework based deployment of network slices enhances the user experience by reducing the latency involved in performing various User Equipment activities and increasing data plane throughput. Moreover, ONVM-5G also helps in achieving the 5G goals by allowing the network operators to efficiently serve the users in small dense cells and make service level isolation among the diverse users through network slicing by providing a network in a box like deployment of 5GC.

IPsec for high speed network links: Performance analysis and enhancements

Network packets security has always been significantly important and well researched topic but the network throughput and latency are not optimal on high speed network links, when using existing IPsec solutions. Network packet processing in Linux kernel is significantly slow (especially for 10-G/40-G link speed) due to context switching associated with system calls, and transitional copy operations in packet traversal through all network layers. Control plane layered packet processing involve copy operation per layer, which increases the packet processing time and consequently decreases the throughput of the network. In contrast to the kernel networking, data plane solutions like DPDK (Data Plane Development Kit) provide direct access to packets (from NIC) in user-space bypassing kernel stack, with zero intermediate copy operations and no context switching. For the normal packets, Intel DPDK claims 10x improvement in the throughput over kernel networking. Being inspired by that remarkable efficiency, we have done empirical evaluation of IPsec performance in data plane. Towards this goal, primarily we have analyzed the performance effect by individual bottleneck modules of strongSwan (an IPsec implementation); by redesigning them with data plane equivalent modules. Secondarily, we have proposed an efficient solution for strongSwan using DPDK API; which eliminates all previously identified bottleneck modules. In the proposed design, multi-cores design has been incorporated in the crypto module and performance is analyzed in terms of throughput and latency. There is an improvement of up to 3.54x in throughput and 2.54x improvement in latency as compared to existing control plane design. With AES128GCM as encryption scheme, a maximum throughput of 4.795 Gbps is achieved, while using only two cores.

ParaGraph: Subgraph-Level Network Function Composition With Delay Balanced Parallelism

Recent efforts in the network function virtualization (NFV) field have targeted ameliorating end-to-end latency of service function chains (SFCs) using network function (NF) composition. NF composition breaks the NF into building blocks and decides the appropriate combination for these blocks. However, two issues remain in current NF composition methods: (1) In the sequential scope, the fine-grained function's block-level composition eliminates redundancy, but with the drawback of flexibility restriction. (2) In the vertical scope, complete NF parallelism adds overhead in packet copying and reordering. To reconcile this, here we present ParaGraph, a subgraph-level NF composition with delay-balanced parallelism. ParaGraph has three main components: an NF subgraph-extraction module that extrapolates right-grained core function subgraphs from NFs; an orchestrator that dynamically composes subgraphs with delay-balanced parallelism; and an infrastructure performing lightweight packet copying and merging. We implement a ParaGraph prototype based on Click and the Data Plane Development Kit (DPDK); extensive evaluations show that with minimum overhead, ParaGraph reaches line-speed packet processing and reduces latency by up to 55% compared to state-of-the-art methods.

Optimization of traditional Snort intrusion detection system

With the rapid development of the Internet, the following network security issues are increasingly prominent and the increasing number of network attacks has also attracted the attention of more professionals. Network attacks are generally divided into operation attack, spoofing attack, flooding attack, redirection and so on. In order to ensure the security of computer system, intrusion detection system is designed, and people pay more and more attention to it. Firewall as the first security gate to maintain network security, intrusion detection system is undoubtedly the second security gate after the firewall. Snort intrusion detection system is a typical application of intrusion detection system. In addition, Snort is a real-time traffic analysis system that can capture and analyze packets on the network according to defined rules. However, with the continuous increase of data volume and the emergence of big data, the pattern library of Snort intrusion detection system also expands correspondingly, leading to the decrease of detection efficiency. DPDK(Data Plane Development Kit) adopts polling method to realize data packet processing, which saves CPU interrupt time, memory copy time, and provides a simple and efficient data packet processing method to the application layer, making the development of network applications more convenient. How to improve the efficiency of Snort intrusion detection system with the advantage of DPDK’s high-performance packet processing is the research focus of this paper.

An Accurate and Efficient Modeling Framework for the Performance Evaluation of DPDK-Based Virtual Switches

Data plane development kit (DPDK) works as a specialized library that enables virtual switches to accelerate the processing of incoming packets by, among other things, balancing the incoming flow of packets over all the CPU cores and processing packets by batches to make a better use of the CPU cache. Although DPDK has become a de facto standard, the performance modeling of a DPDK-based vSwitch remains a challenging problem. In this paper, we present an analytical queueing model to evaluate the performance of a DPDK-based vSwitch. Such a virtual equipment is represented by a complex polling system in which packets are processed by batches, i.e., a given CPU core processes several packets of one of its attached input queues before switching to the next one. To reduce the complexity of the associated model, we develop a general framework that consists in decoupling the polling system into several queueing subsystems, each one corresponding to a given CPU core. We resort to servers with vacation to capture the interactions between subsystems. Our proposed solution is conceptually simple, easy to implement and computationally efficient. Tens of comparisons against a discrete-event simulator show that our models typically deliver accurate estimates of the performance parameters of interest (e.g., attained throughput, packet latency or loss rate). We illustrate how our models can help in determining an adequate setting of the vSwitch parameters using several real-life case studies.

A Scalable VPN Gateway for Multi-Tenant Cloud Services

Major cloud providers offer networks of virtual machines with private IP addresses as a service on the cloud. To isolate the address space of different customers, customers are required to tunnel their traffic to a Virtual Private Network (VPN) gateway, which is typically a middlebox inside the cloud that internally tunnels each packet to the correct destination. To improve performance, an increasing number of enterprises connect directly to the cloud provider's network at the edge, to a device we call the provider's edge (PE). PE is a chokepoint for customer's traffic to the cloud, and therefore a natural candidate for implementing network functions concerning customers' virtual networks, including the VPN gateway, to avoid a detour to middleboxes inside the cloud. At the scale of today's cloud providers, VPN gateways need to maintain information for around a million internal tunnels. We argue that no single commodity device can handle these many tunnels while providing a high enough port density to connect to hundreds of cloud customers at the edge. Thus, in this paper, we propose a hybrid architecture for the PE, consisting of a commodity switch, connected to a commodity server which uses Data-Plane Development Kit (DPDK) for fast packet processing. This architecture enables a variety of network functions at the edge by offering the benefits of both hardware and software data planes. We implement a scalable VPN gateway on our proposed PE and show that it matches the scale requirements of today's cloud providers while processing packets close to line rate.

Performance measurement using dpdk in software-defined local and wide area networks

Background/Objectives: For data center-based enterprises, the use of data traffic continues to increase. As a result, the increasingly efficient processing of increasing data traffic is becoming a major issue. Effective processing of traffic can be performed through the addition of physical network equipment, but this requires considerable costs.Methods/Statistical analysis: To solve this problem, researches on server virtualization and network virtualization technology are being actively conducted. However, while network virtualization is a cost-effective solution, open-source virtual switches used in network virtualization technologies have the performance penalty because they handle packets at the kernel of server's operating system. As a result, the Intel has developed the Data Plane Development Kit (DPDK) technology to address the performance degradation of the operating system.Findings: In this paper, we propose the DPDK performance test environment based on Open Virtual Switch (OVS) to verify the stability and performance of the DPDK-oriented virtualization technology, in association with a new KREONET-S project which aims tothe softwarization of the Korea Research Environment Open Network (KREONET) infrastructure.Improvements/Applications: We perform conducted experiments on Software-Defined Local Area Network (LAN) and Wide Area Network (WAN) environment using KREONET-S show the result.

Statelet-Based Efficient and Seamless NFV State Transfer

Network functions virtualization (NFV) environments can provide increased elasticity and flexibility for operators, as network-related services can be scaled and moved as needed. Such operations require a seamless transfer of state to provide a service without interruption or performance degradation. In this paper, we propose and analyze a novel approach for efficient and seamless NFV state transfers. Our approach is based on the concept of statelets, which are compact representations of information in incoming packets that change the state of a virtualized network function. We present and describe slim migration (SliM), a system for efficient NFV state transfers using a statelet interface that we have implemented as an add-on to the data plane development kit, a high-performance packet I/O library. We have evaluated SliM in a testbed and present results that show its benefits in terms of lower delays and lower packet-loss rates. Moreover, our analysis and evaluation results show that SliM offers three times as much shared link capacity to the dataplane as previous approaches, while reducing the duration of a state transfer to one-third of their time.

HYPER: A Hybrid High-Performance Framework for Network Function Virtualization

Network function virtualization (NFV) offers the potential for both enhancing service delivery flexibility and reducing overall costs by virtualizing network functions that are traditionally implemented in dedicated hardware. However, the flexibility of NFV comes with considerable compromises since virtual machine carried functions could introduce significant performance overhead. In this paper, we present a novel high-performance framework called HYPER, which combines programmable hardware infrastructure and traditional software infrastructure in NFV to achieve both high performance and flexibility for supporting virtualized network functions (VNFs). In HYPER, we design a mediator layer to hide underlying infrastructure heterogeneity from the NFV orchestrator to simplify VNF management. In addition, we design a SLA-aware service chaining algorithm in HYPER to leverage the benefits of the hybrid infrastructure to fulfill both functional and performance requirements from service subscribers (or tenants). To optimize resource utilization efficiency, we also introduce a performance-aware VNF placement algorithm in HYPER, which accommodates both resource and performance requirements in placing VNFs. We implement HYPER in a testbed based on OpenStack and ONetCard. Experimental results show that HYPER reduces the forwarding latency of a service chain by 40% to 67% compared with data plane development kit -based implementation, while maintaining the flexibility of VNF management.

Inter-Burst Segregation Protocol Guaranteeing Loss-Free Packet-Switched Networks

In this letter, we propose a novel protocol, inter-burst segregation protocol (IBSP), which guarantees zero packet loss in packet-switched networks. The protocol is implemented and evaluated in network simulator-3 and in the data plane development kit (DPDK) implemented by INTEL. The results confirm that a packet-switched network can achieve zero packet-loss using IBSP, although nearly all the bandwidth is consumed in the network. In addition, the jitter is significantly low and bounded using IBSP.

BENEFITS FROM BREAKING UP WITH LINUX NATIVE PACKET PROCESSING WHILE USING INTEL DPDK LIBRARIES

The Intel Data Plane Development Kit (DPDK) is a set of libraries and drivers for fast packet processing in Linux. It is a dedicated framework for building efficient high-speed data plane applications supporting QoS features with poll mode drivers which are supporting virtual and physical NIC’s so environment can be used to build efficient data plane applications for packet networks. The results of test on Quality of Service Metering Sample Application are presented.