High-speed Network Links Research Articles

QUIC on the Fast Lane: Extending Performance Evaluations on High-rate Links

QUIC is a new protocol standardized in 2021 designed to improve on the widely used TCP/TLS stack. The main goal is to speed up web traffic via HTTP, but it is also used in other areas like tunneling. Based on UDP, it offers features like reliable in-order delivery, flow and congestion control, stream-based multiplexing, and always-on encryption using TLS 1.3.Unlike TCP, QUIC integrates these capabilities in user space, relying on kernel interaction solely for UDP. Operating in user space allows more flexibility but sacrifices some kernel-level efficiency and optimization that TCP benefits from. Various QUIC implementations exist, each distinct in programming language, architecture, and design.QUIC is already widely deployed on the Internet and has been evaluated, focussing on low latency, interoperability, and standard compliance. However, benchmarks on high-speed network links are still scarce.This paper presents an extension to the QUIC Interop Runner, a framework for testing the interoperability of QUIC implementations. Our contribution enables reproducible QUIC benchmarks on dedicated hardware and high-speed links. We provide results on 10G links, including multiple implementations, evaluate how OS features like buffer sizes and NIC offloading impact QUIC performance, and show which data rates can be achieved with QUIC compared to TCP. Moreover, we analyze different CPUs and CPU architectures influence reproducible and comparable performance measurements. Furthermore, our framework can be applied to evaluate the effects of future improvements to the protocol or the OS.Our results show that QUIC performance varies widely between client and server implementations from around 50Mbit/s to over 6000Mbit/s. We show that the OS generally sets the default buffer size too small. Based on our findings, the buffer size should be increased by at least an order of magnitude. Our profiling analysis identifies Packet I/O as the most expensive task for QUIC implementations. Furthermore, QUIC benefits less from AES NI hardware acceleration while both features improve the goodput of TCP to around 8000Mbit/s. The lack of support for NIC offloading from QUIC implementations results in missed opportunities for performance improvement.The assessment of CPUs from different vendors and generations revealed significant performance variations. We employed core pinning to examine if the performance of QUIC implementations is affected by the allocation to specific CPU cores. The results indicated an increased goodput of up to 20% when running on a specifically chosen core compared to a randomly assigned core. This outcome highlights the impact of CPU core selection on the performance of QUIC implementations but also for reproducible measurements.

On High-Speed Flow-Based Intrusion Detection Using Snort-Compatible Signatures

Signature-based Network Intrusion Detection Systems (NIDS) have become state-of-the-art in modern network security solutions. However, most systems are not designed for modern high-speed network links. In the field of network monitoring, an alternative solution has become the choice for such high-speed networks. Flow-monitoring, typically based on the Internet Protocol Flow Information Export (IPFIX) standard, now goes well beyond collecting statistical information about network connections. Current solutions are even able to include selected parts of the payload in these Flows to be used in conjunction with NIDS. Recently, we extended this concept to application layer HTTP Flows. We now present our improved version of the IPFIX-based Signature-based Intrusion Detection System (FIXIDS). <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Fixids</small> makes use of HTTP intrusion detection signatures from the popular Snort system and applies them to incoming IPFIX-conforming HTTP Flows. Our evaluation shows that <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Fixids</small> can deal with four times higher network data rates without drops compared to Snort, while maintaining the same event detection rate. Furthermore, a substantial part of the data traffic can be outsourced to <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Fixids</small> so that Snort can be relieved of a significant portion of rules and traffic. This increases both the detection rate and the data rate the overall security appliance can handle.

IPsec for high speed network links: Performance analysis and enhancements

Network packets security has always been significantly important and well researched topic but the network throughput and latency are not optimal on high speed network links, when using existing IPsec solutions. Network packet processing in Linux kernel is significantly slow (especially for 10-G/40-G link speed) due to context switching associated with system calls, and transitional copy operations in packet traversal through all network layers. Control plane layered packet processing involve copy operation per layer, which increases the packet processing time and consequently decreases the throughput of the network. In contrast to the kernel networking, data plane solutions like DPDK (Data Plane Development Kit) provide direct access to packets (from NIC) in user-space bypassing kernel stack, with zero intermediate copy operations and no context switching. For the normal packets, Intel DPDK claims 10x improvement in the throughput over kernel networking. Being inspired by that remarkable efficiency, we have done empirical evaluation of IPsec performance in data plane. Towards this goal, primarily we have analyzed the performance effect by individual bottleneck modules of strongSwan (an IPsec implementation); by redesigning them with data plane equivalent modules. Secondarily, we have proposed an efficient solution for strongSwan using DPDK API; which eliminates all previously identified bottleneck modules. In the proposed design, multi-cores design has been incorporated in the crypto module and performance is analyzed in terms of throughput and latency. There is an improvement of up to 3.54x in throughput and 2.54x improvement in latency as compared to existing control plane design. With AES128GCM as encryption scheme, a maximum throughput of 4.795 Gbps is achieved, while using only two cores.

Per-Flow Queue Management with Succinct Priority Indexing Structures for High Speed Packet Scheduling

Priority queues are essential building blocks for implementing advanced per-flow service disciplines and hierarchical quality-of-service at high-speed network links. Scalable priority queue implementation requires solutions to two fundamental problems. The first is to sort queue elements in real time at ever increasing line speeds (e.g., at OC-768 rates). The second is to store a huge number of packets (e.g., millions of packets). In this paper, we propose novel solutions by decomposing the problem into two parts, a succinct priority index (PI) in SRAM that can efficiently maintain a real-time sorting of priorities, coupled with a DRAM-based implementation of large packet buffers. In particular, we propose three related novel succinct PI data structures for implementing high-speed PIs: a PI, a counting priority index (CPI), and a pipelined counting priority index (pCPI). We show that all three structures can be very compactly implemented in SRAM using only ⊖(U) space, where U is the size of the universe required to implement the priority keys (time stamps). We also show that our proposed PI structures can be implemented very efficiently as well by leveraging hardware-optimized instructions that are readily available in modern 64-bit processors. The operations on the PI and CPI structures take ⊖(logW U) time complexity, where W is the processor word length (i.e., W = 64). Alternatively, operations on the pCPI structure take amortized constant time with only ⊖(logW U) pipeline stages (e.g., only four pipeline stages for U = 16 million). Finally, we show the application of our proposed PI structures for the scalable management of large packet buffers at line speeds. The pCPI structure can be implemented efficiently in high-performance network processing applications such as advanced per-flow scheduling with quality-of-service guarantee.

멀티 코어 환경에서 실시간 트래픽 분석 시스템 처리속도 향상

오늘날 네트워크 환경은 응용 프로그램 및 서비스의 변화가 많아 응용탐지에 있어 기존의 단일 분석 알고리즘으로는 모든 트래픽의 응용을 정확하게 탐지하기 어렵다. 최근 이러한 단점을 보완하기 위해 여러 개별 알고리즘을 통합한 멀티 레벨의 트래픽 탐지 알고리즘에 대한 연구가 진행되고 있다. 이러한 멀티 레벨 탐지 알고리즘은 단일 알고리즘 구조에 비해 계산 복잡도가 높은 단점이 있다. 또한, 고속 네트워크에서 실시간으로 트래픽을 분류하기 위해서는 멀티코어 CPU의 장점인 병렬처리를 이용하여 높은 계산 복잡도를 해결해야 할 필요가 있다. 본 논문에서는 요즘 일반화된 멀티 코어 CPU환경에 적합한 실시간 응용 트래픽 탐지 시스템 구조를 제안한다. 먼저 멀티 레벨 트래픽 탐지 알고리즘이 멀티 코어 환경에서 실시간으로 동작하기 위한 고려 사항들을 살펴보고, 이를 통해 시스템을 설계하고 구현한 내용을 기술한다. 본 논문에서 구축한 시스템은 캠퍼스 네트워크와 기숙사 네트워크를 대상으로 구축하여 그 실효성을 검증하였다. The application traffic analysis is getting more and more challenging due to the huge amount of traffic from high-speed network link and variety of applications running on wired and wireless Internet devices. Multi-level combination of various analysis methods is desired to achieve high completeness and accuracy of analysis results for a real-time analysis system, while requires much of processing burden on the contrary. This paper proposes a novel architecture for a real-time traffic analysis system which improves the processing performance on multi-core CPU environment. The main contribution of the proposed architecture is an efficient parallel processing mechanism with multiple threads of various analysis methods. The feasibility of the proposed architecture was proved by implementing and deploying it on our campus network.

실시간 트래픽 분석을 위한 운영체제 판별 방법에 관한 연구

현대인의 삶에서 인터넷은 다양한 정보를 제공하는 필수 요소가 되었다. 이에 따라 네트워크 트래픽은 폭발적으로 증가하였고, 효율적 네트워크 관리를 위해 네트워크 트래픽 분석의 중요성이 강조되고 있다. 네트워크 트래픽 분석 방법 중 시그니쳐 기반의 분석 방법론이 많이 사용되고 있으며, 이는 다양한 응용의 증가로 시그니쳐의 탐색 공간 증가에 따라 실시간 트래픽 분석에 문제점이 나타나고 있다. 운영체제 정보를 활용하면 해당 운영체제에서 사용되는 응용의 시그니쳐만을 검색하도록 함으로써 앞선 문제점을 해결할 수 있다. 본 논문에서는 실시간 트래픽 분석을 위한 효과적인 운영체제 판별 방법을 제안한다. 본 논문에서 제안하는 운영체제 판별 방법은 실시간 트래픽 분석에 적합한 가볍고 빠른 수동형 방법을 사용하였으며, 기존 수동형 방법이 가지는 분석률과 정확성이 낮은 문제를 해결하였다. 분석률을 향상시키기 위해 입력데이터를 확장시켰으며, 운영체제 판별을 위한 시그니쳐를 HTTP의 User-Agent를 이용하여 생성함으로써 다양한 운영체제에 대한 시그니쳐를 추출하였다. 또한 기존 패킷 기반의 분석을 플로우 단위의 분석으로 변경함으로써 정확성을 향상시켰다. The Internet has become an essential part in our modern life by providing useful information. So, the volume of Internet traffic has been increasing rapidly, which emphasizes the importance of network traffic analysis for effective network operation and management. Signature based analysis have been commonly used, but it is shown that the increase of signatures due to the increase of applications causes the performance degradation of real-time traffic analysis on high-speed network links. In this paper, we propose OS fingerprinting method for real-time traffic analysis. The previous problems can be solved by utilizing the OS information. The OS fingerprinting method for real-time traffic analysis, proposed in this paper, conducts under passive mode, and improves the limitation of a previous method such as low completeness and accuracy. In this paper, we enlarged an input data to improve completeness, and used the User-Agent field in HTTP packet to extract various OS signatures. Also, we changed an input data from packet to flow to improve accuracy.

Performance analysis of high rate packet capture on multiprocessor platform

With the continuous improvement of transmission rate, high speed network links require good performance of packet capture. The multiprocessor platform has strong computational capabilities, and brings new chance for high rate packet capture. In this paper, we analyze the performance of common packet capture approaches that are based on general-purpose multiprocessor platform. The analysis contains two aspects: one is the maximum packet capture rate and throughput on multiprocessor platform, the other is central processing unit (CPU) load under the maximum capture rate. By comparing and analyzing the experimental result, we give the maximum packet capture rate and throughput of different capture approaches. Furthermore, we analyze the CPU load which is produced by two capture processes run on the multiprocessor platform simultaneously and make a comparison with the single capture process.

Pipelined Control-Path Effects on Area and Performance of a Wormhole-Switched Network-on-Chip

This paper presents design trade-off and performance impacts of the amount of pipeline phase of control path signals in a wormhole-switched network-on-chip (NoC). The numbers of the pipeline phase of the control path vary between twoand one-cycle pipeline phase. The control paths consist of the routing request paths for output selection and the arbitration paths for input selection. Data communications between on-chip routers are implemented synchronously and for quality of service, the inter-router data transports are controlled by using a link-level congestion control to avoid lose of data because of an overflow. The trade-off between the area (logic cell area) and the performance (bandwidth gain) of two proposed NoC router microarchitectures are presented in this paper. The performance evaluation is made by using a traffic scenario with different number of workloads under 2D mesh NoC topology using a static routing algorithm. By using a 130-nm CMOS standard-cell technology, our NoC routers can be clocked at 1 GHz, resulting in a high speed network link and high router bandwidth capacity of about 320 Gbit/s. Based on our experiments, the amount of control path pipeline stages gives more significant impact on the NoC performance than the impact on the logic area of the NoC router. Keywords—Network-on-Chip, Synchronous Parallel Pipeline, Router Architecture, Wormhole Switching

이중 연결 구조 CC-NUMA 시스템의 효율적인 상호 연결망 구성 기법

반도체 미세 공정의 개발과 더불어, 높아진 집적도 및 동작 클럭의 고속화로 단일 프로세서 시스템 성능은 지속적으로 개선되고 있다. 이 결과 기가헬즈 이상의 클럭 속도를 가지는 개인용 컴퓨터가 보편적인 데스크 탑 시스템으로 자리잡게 되었으며, 불과 수년 전의 고가 대형 시스템은 점차 이러한 작은 시스템들을 상호 연결망으로 연결한 형태로 급속히 대체되어가고 있다. 이러한 구조의 클러스터 컴퓨터는 높은 확장성과 고성능을 얻을 수 있으므로, 점차 그 영역을 확대해나가고 있으나, 상호 연결망의 대역폭 및 지연에 따라 성능 제한 요소는 여전히 존재하고 있으며, 이러한 이유로 SCI, Myrinet, Gigabit Ethernet 등 고속의 상호 연결망이 클러스터 시스템의 연결 구조로 사용되고 있다. 프로세서 속도의 개발과 더불어 상호 연결망의 속도 또한 개선되어 왔는데, 상호 연결망은 그 대역폭을 늘리는 것과, 상호 연결망을 이용한 경우의 통신 시간지연의 축소로 볼 수 있다. 대역폭의 확장 및 지연시간의 단축은 상호 연결망의 고속화를 통하여 이루어질 수 있으나, 작은 면적에 집적되어 있는 프로세서와는 달리, 보다 넓은 면적에 펼쳐져 있는 상호 연결망의 동작 속도는, 물리적 거리에 의한 지연으로 인하여 개선의 난이도가 높으며, 따라서 클러스터 시스템의 확장 규모는 상호 연결망의 병목 현상에 의하여 제한된다고 할 수 있다. 이러한 이유로 보다 높은 대역폭의 상호 연결망을 구현하려는 노력은 복수개의 연결 구조를 이용한 형태로 개선되어 왔으며, 고속으로 동작하는 SCI 점 대 점 연결구조론 이용한 다중연결 형태의 시스템이 활발히 연구되어 왔다. 본 논문은 이러한 이중 점 대 점 연결 구조 시스템의 성능 제한 요소인 접근 시간 및 효율을 개선하기 위하여, 두개 중 하나의 점 대 점 연결을 링 형태로, 나머지 하나는 링을 몇 개의 노드의 묶음으로 분할하여 연결하는 구성을 제시하였으며, 방송 및 일 대 일 전송에 적합한, 간단하고 효율적인 경로 설정 방법과 적절한 묶음의 수를 제시하였다. 본 논문에 제시한 구조의 시스템의 성능 측정의 비교 대상으로, 최신 시스템에 채용되어 있는 반대방향 이중 링 구조를 비교 대상으로 하였으며, 반대방향 이중 연결 구조에 비하여 단 논문에 제시한 상호연결망 구성 및 트랜잭션 경로 설정 방법이 상대적으로 우수함을 시뮬레이션을 통하여 검증하였다. 실험 결과, 본 논문에서 제안한 상호연결망 구조 및 트랜잭션 경고 설정 방법을 이용한 경우, 반대방향 이중 링 구조의 시스템 구조에 비하여 단위 트랜잭션의 처리 시간이 1.05∼l.11배 향상되었으며, 시스템의 성능은 1.42∼2.1배 향상되었다. The performance of the multiprocessor systems is limited by the several factors. The system performance is affected by the processor speed, memory delay, and interconnection network bandwidth/latency. By the evolution of semiconductor technology, off the shelf microprocessor speed breaks beyond GHz, and the processors can be scalable up to multiprocessor system by connecting through the interconnection networks. In this situation, the system performances are bound by the latencies and the bandwidth of the interconnection networks. SCI, Myrinet, and Gigabit Ethernet are widely adopted as a high-speed interconnection network links for the high performance cluster systems. Performance improvement of the interconnection network can be achieved by the bandwidth extension and the latency minimization. Speed up of the operation clock speed is a simple way to accomplish the bandwidth and latency betterment, while its physical distance makes the difficulties to attain the high frequency clock. Hence the system performance and scalability suffered from the interconnection network limitation. Duplicating the link of the interconnection network is one of the solutions to resolve the bottleneck of the scalable systems. Dual-ring SCI link structure is an example of the interconnection network improvement. In this paper, I propose a network topology and a transaction path algorism, which optimize the latency and the efficiency under the duplicated links. By the simulation results, the proposed structure shows 1.05 to 1.11 times better latency, and exhibits 1.42 to 2.1 times faster execution compared to the dual ring systems.