Computer networks require increasingly complex packet processing functions in the data plane to adapt to new requirements. To meet performance demands, packet processing systems on routers employ multiple processor cores. To efficiently utilize processing resources in such systems, we propose a novel methodology for allocating tasks to processors. The main idea is to obtain runtime profiling information and to duplicate tasks with heavy processing requirements. Using our duplication algorithm, a balanced workload can be obtained and the complexity of packing tasks with different processing requirements can be reduced. By translating traffic characteristics into processing requirements, the system is able to adapt to dynamic changes in the workload and balance the utilization of all processing resources to maximize system throughput. Our approach can adapt to any traffic change in a single iteration, whereas existing adaptive approaches may require multiple steps. Results from our prototype implementation based on the Click modular router show that our system only requires on average 5.3-31.5 percent of the adaptation steps that are necessary in iterative systems. In addition, our system achieves a throughput that is 1.32 times higher than the throughput achieved with symmetric multiprocessing support with general-purpose task allocation.

Programmable packet processors have replaced traditional fixed-function custom logic in the data path of routers. This programmability introduces new vulnerabilities in these systems that can lead to new types of network attacks. We propose a modular packet processor monitoring technique that can help in detecting and avoiding such attacks. Using information about the processing time distribution of individual modules, input/output traffic characteristics can be inferred and abnormal behavior can be detected.

We present the first practical example of an entirely new class of network attacks - attacks that target the network infrastructure. Modern routers in computer networks use general-purpose programmable packet processors. The software used for packet processing on these systems is potentially vulnerable to remote exploits. In this paper, we demonstrate a specific attack that can launch a devastating denial-of-service attack by sending just a single packet. We show that vulnerable packet processing code can be exploited on a Click modular router as well as on a custom packet processor on the NetFPGA platform. We also show that defense techniques based on processor monitoring that we have proposed in prior work can help in detecting and avoiding such attacks.

Network virtualization requires careful control of networking resources, including link bandwidth, router memory, and packet processing time. Isolation and fair sharing of processing resources in current high-performance packet processors occur at the granularity of entire processor cores. Scaling of network virtualization to larger numbers of parallel slices requires a more fine-grained processor sharing mechanism. Our work presents a novel approach, called Fair Multithreading (FMT), that allows hardware threads to share a processor core while ensuring isolation and weighted fair access. We present an analysis of the FMT algorithm and a prototype implementation on a NetFPGA system. Our evaluation results indicate that FMT can be implemented at speeds that are necessary to make scheduling decisions at the instruction level. We show the impact of having such fine-grained processor schedulers in substrate nodes by comparing the resource utilization of virtual network slices in our system to traditional whole-core allocations. Our simulation results show the FMT-based substrate networks can be utilized more efficiently and more virtual network requests can be accommodated. These results indicate the significant improvement in system scalability that can be gained from our fine-grained processor scheduling system.

Programmable packet processors have replaced traditional fixed-function custom logic in the data path of routers. Programmability of these systems allows the introduction of new packet processing functions, which is essential for today's Internet as well as for next-generation network architectures. Software development for many existing implementations of these network processors requires a deep understanding of the architecture and careful resource management by the software developer. Resource management that is tied to application development makes it difficult for packet processors to adapt to changes in the workload that are based on traffic conditions and the deployment of new functionality. Therefore, we present a network processor design that separates programming from resource management, which simplifies the software development process and improves the system's ability to adapt to network conditions. Based on our initial system design, we present a prototype implementation of a 4-core network processor using the NetFPGA platform. We demonstrate the operation of the system using header-processing and payload-processing applications. For packet forwarding, our simplified network processor can achieve a throughput of 2.79 Gigabits per second at a clock rate of only 62.5 MHz. Our results indicate the proposed design can scale to configurations with many more processors that operate at much higher clock rates and thus can achieve considerable higher throughput while using modest amounts of hardware resources.

With dozens to hundreds of processing cores deployed in next generation packet processor, regular topologies such as mesh are widely adopted in Network-on-Chip design to provide scalable interconnection to cores. Although such packet processors are rich in raw system processing power, utilization of hardware resource plays a critical role in overall system performance. In this paper, we focus on processing task mapping and on-chip packet routing, which are the key issues for data path performance on next-generation packet processors. We present a genetic algorithm to explore the assignment of tasks, and utilize on-chip interconnections by splitting the traffic between cores across multiple paths. The split flow traffic assigned to each routing path is solved with linear programming. Our experimental results on a packet processor architecture prototype show that the proposed algorithm is efficient and scalable.

Customizable packet processing is an important aspect of next-generation networks. Packet processing architectures using multi-core systems on a chip can be difficult to program. In our work, we propose a new packet processor design that simplifies packet processing by managing packet contexts in hardware. We show how such a design scales to large systems. Our results also show that the management of such a system is feasible with the proposed mapping algorithm.

Designs of next-generation Internet architectures propose a diverse and changing set of features in the data path of routers. These routers require high-performance programmable packet processing platforms to allow for dynamic feature deployment and adaptation. In this paper, we present programming abstractions that quantifies processing and storage of network services. We further devise a runtime environment that provides the ability of adaptation to dynamically deployed network services and varying network traffic.

Computer networks require increasingly complex packet processing in the data path to adapt to new functionality requirements. To meet performance demands, packet processing systems on routers employ multiple processor cores. We investigate the design of an efficient run-time management system that handles the allocation of processing tasks to processor cores. Using run-time profiling information about processing requirements and traffic characteristics, the system is able to adapt to dynamic changes in the workload and balance the utilization of all processing resources to maximize throughput. We present a prototype implementation of our system that is based on the Click modular router. Our results show that our prototype system can adapt to changing workloads and process computationally demanding packets at 1.32 times higher data rates than SMP Click.