Many critical applications, such as network monitoring, firewall, or VPN acceleration, are based on connection tracking. This process aggregates packets into network flows and tracks the state of each active flow. It is a challenging task to implement connection tracking for a high-speed network link. It needs to be accelerated in hardware (because of high packet rates) and also utilize external memory (because of high active flow counts). However, the latency of external memory access can seriously impact the performance of connection tracking if not handled properly. This demo showcases our implementation of a high-speed connection tracking table (CTT) that targets FPGA SmartNICs. It supports 400 Gbps throughput and up to 512 M of active flows. We also demonstrate the integration of our FPGA firmware with IPFIXProbe, an open-source monitoring software developed by CESNET.

Intrusion Detection Systems (IDSes) are a widely used network security tool. However, achieving sufficient throughput is challenging as network link speeds increase to 100 or 400 Gbps. Despite the large number of papers focusing on the hardware acceleration of IDSes, the approaches are mostly limited to the acceleration of pattern matching or do not support all types of IDS rules. Therefore, we propose hardware acceleration that significantly increases the throughput of IDSes without limiting the functionality or the types of rules supported. As the IDSes cannot match signatures in encrypted network traffic, we propose a hardware TLS pre-filter that removes encrypted TLS traffic from IDS processing and doubles the average processing speed. Implemented on an acceleration card with an Intel Agilex FPGA, the pre-filter supports 100 and 400 Gbps throughput. The hardware design is optimized to achieve a high frequency and to utilize only a few hardware resources.

Packet classification, i.e., the process of categorizing packets into flows, is a first-class citizen in any networking device. Every time a new packet has to be processed, one or more header fields need to be compared against a set of pre-installed rules. This is done for basic forwarding operations, to apply security policies, application-specific processing, or quality-of-service guarantees. A lot of research efforts have identified better lookup techniques, i.e., finding the best match between packet headers and rules, by capitalizing on the rule sets characteristics. Here, ClassBench has greatly served the community by enabling the generation of IPv4 rule sets. In this paper, we present a new tool, ClassBench-ng, that creates synthetic IPv4, IPv6, and OpenFlow rules. We start from an analysis of classification rules deployed in-the-wild and we use the findings to craft our solution. ClassBench-ng can generate a user-defined number of rules as well as an associated header trace matching them. Compared to state-of-the-art solutions, the rule set generation process is usually more accurate and it is able to produce rules matching a number of different use cases, i.e., from an IPv4 router to an OpenFlow switch, which is unique among current rule set generation tools.

Increasing speed of network links continuously pushes up requirements on the performance of network security and monitoring systems, including their typical representative and its core function: an intrusion detection system (IDS) and pattern matching. To allow the operation of IDS applications like Snort and Suricata in networks supporting throughput of 100Gbps or even more, a recently proposed pre-filtering architecture approximates exact pattern matching using hash-based matching of short strings that represent a given set of patterns. This architecture can scale supported throughput by adjusting the number of parallel hash functions and on-chip memory blocks utilized in the implementation of a hash table. Since each hash function can address every memory block, scaling throughput also increases the total capacity of the hash table. Nevertheless, the original architecture utilizes the available capacity of the hash table inefficiently. We therefore propose three optimization techniques that either reduce the amount of information stored in the hash table or increase its achievable occupancy. Moreover, we also design modifications of the architecture that enable resource-efficient utilization of all three optimization techniques together in synergy. Compared to the original pre-filtering architecture, combined use of the proposed optimizations in the 100Gbps scenario increases the achievable capacity for short strings by three orders of magnitude. It also reduces the utilization of FPGA logic resources to only a third.

Gradually increasing throughput of high-speed networks puts continuous pressure on the performance of operations over a stream of network data. Probably the most affected operation in the area of network security and monitoring is pattern matching, which is in the core of widely deployed intrusion detection systems (IDSes) like Snort, Suricata and Bro. This paper therefore proposes several optimizations of a hash-based pattern matching architecture that together allow to increase its throughput to 100 Gbps and beyond. Proposed optimizations target an interconnection network between parallel hash function engines and independent memory blocks addressed by hashes computed over short strings of input data. Specifically, the optimizations reduce resource utilization by sharing parts of the full interconnection network among its several outputs and lower collision rate in these shared parts by aggregation and distributed buffering of memory access requests. The optimized pattern matching architecture is therefore able to utilize a higher number of parallel hash functions, each of which can use the interconnection network to access any memory block. This allows not only to increase the throughput of a key component within IDSes to more than 100 Gbps, but also to support a larger set of network threat patterns and to update this set dynamically.

With an increasing speed of network links, it is also necessary to increase the throughput of network security systems. An intrusion detection system (IDS) is one of the key components in the protection of network infrastructure. Unfortunately, the IDS has to match a large set of regular expressions (REs) in network streams, which has a negative impact on its throughput. A fast pre-filtration of network traffic can allow to achieve a higher overall throughput. Therefore, we have designed a new algorithm, which is able to select short strings that represent an RE set utilized in the IDS. Compared to previous methods, strings are selected in less than a second for an RE and can reduce network traffic up to 3.3 times better. As all selected strings have the same length, they can be used in a hash-based pre-filter, which is able to process more 100 Gbps of network traffic.

Deep packet inspection via regular expression (RE) matching is a crucial task of network intrusion detection systems (IDSes), which secure Internet connection against attacks and suspicious network traffic. Monitoring high-speed computer networks (100 Gbps and faster) in a single-box solution demands that the RE matching, traditionally based on finite automata (FAs), is accelerated in hardware. In this paper, we describe a novel FPGA architecture for RE matching that is able to process network traffic beyond 100 Gbps. The key idea is to reduce the required FPGA resources by leveraging approximate nondeterministic FAs (NFAs). The NFAs are compiled into a multi-stage architecture starting with the least precise stage with a high throughput and ending with the most precise stage with a low throughput. To obtain the reduced NFAs, we propose new approximate reduction techniques that take into account the profile of the network traffic. Our experiments showed that using our approach, we were able to perform matching of large sets of REs from SNORT, a popular IDS, on unprecedented network speeds.

Regular expression matching (RE matching) is a widely used operation in network security monitoring applications. With the speed of network links increasing to 100 Gbps and 400 Gbps, it is necessary to speed up packet processing and provide RE matching at such high speeds. Although many RE matching algorithms and architectures have been designed, none of them supports 100 Gbps throughput together with fast updates of an RE set. Therefore, this paper focuses on the design of a new hardware architecture that addresses both these requirements. The proposed architecture uses multiple highly memory-efficient Delayed Input DFAs (D2FAs), which are organized to a processing pipeline. As all D2FAs in the pipeline have only local communication, the proposed architecture is able to operate at high frequency even for a large number of parallel engines, which allows scaling throughput to hundreds of gigabits per second. The paper also analyses how to scale the number of engines and the capacity of buffers to achieve desired throughput. Using the parameters obtained while matching a sample RE set represented by a D2FA in a real network traffic, the architecture can be tuned for wire-speed throughput of 400 Gbps.

The paper proposes an architecture of a high-speed regular expression (RE) matching system with fast updates of an RE set. The architecture uses highly memory-efficient Delayed Input DFAs (D2FAs), which are organized to a processing pipeline. The architecture is designed so that it communicates only locally among its components in order to achieve high frequency even for a large number of parallel matching engines (MEs), which allows scaling throughput to hundreds of gigabits per second (Gbps). The architecture is able to achieve processing throughput of up to 400 Gbps on current FPGA chips.

Internet evolution is driven by a continuous stream of new applications and users driving the demand for services. To keep up with this, a never-stopping research has been transforming the Internet ecosystem over the time. Technological changes on both protocols (the uptake of IPv6) and network architectures (the adoption of Software Defined Networking) introduced new challenges for ASIC designers. In particular, IPv6 and OpenFlow increased the complexity of the rule matching problem, pushing researchers to build new packet classiffication algorithms capable to keep pace with a steady growth of link speed. A lot of research effort identifies better lookup techniques capitalizing on the characteristics of rule sets. So far, the availability of small numbers of real rule sets and synthetic ones, generated with tools such as ClassBench, has boosted research in the IPv4 world. Starting from an analysis of rule sets taken from operational environments, we present ClassBench-ng, a new open source tool for the generation of synthetic IPv4, IPv6, and OpenFlow 1.0 rule sets exposing the same properties of real ones. We feel this tool can meet the requirements of nowadays researchers, boosting the rule matching research as ClassBench has done since ten years ago.

Rapidly growing speed and complexity of computer networks impose new requirements on fast lookup structures which are utilized in many networking applications (SDN, firewalls, NATs, etc.). We propose a novel lookup concept based on the well-known cuckoo hashing, which can achieve good memory utilization, supplemented by a binary search tree for offloading the colliding keys and supporting LPM lookup. We also propose a hardware architecture implementing this lookup concept in the FPGA. Our solution is suitable for lookup of the variable-length keys in 100+ Gbps networks. Memory utilization of the proposed concept is thoroughly evaluated and it is shown that the concept is scalable to external memory components.

With growing speed of computer networks, core routers have to increase performance of longest prefix match (LPM) operation on IP addresses. While existing LPM algorithms are able to achieve high throughput for IPv4 addresses, an IPv6 processing speed is limited. To achieve 100 Gbps throughput, LPM operation has to be processed in dedicated hardware and a forwarding table has to fit into an on-chip memory. Current LPM algorithms need large memory to store IPv6 forwarding tables or use compression with dynamic data structres, which can not be simply implemented in hardware. Therefore, we provide analysis of available forwarding tables of core routers and propose a new representation of prefix sets. The proposed representation has very low memory demands and is suitable for high-speed pipelined processing, which is shown on a new highly pipelined hardware architecture with 100 Gbps throughput.

The increasing number of devices connected to the Internet together with video on demand have a direct impact to the speed of network links and performance of core routers. To achieve 100 Gbps throughput, core routers have to implement IP lookup in dedicated hardware and represent a forwarding table using a data structure, which fits into the on-chip memory. Current IP lookup algorithms have high memory demands when representing IPv6 prefix sets or introduce very high pre-processing overhead. Therefore, we performed analysis of IPv4 and IPv6 prefixes in forwarding tables and propose a novel memory representation of IP prefix sets, which has very low memory demands. The proposed representation has better memory utilization in comparison to the highly optimized Shape Shifting Trie (SST) algorithm and it is also suitable for IP lookup in 100 Gbps networks, which is shown on a new pipelined hardware architecture with 170 Gbps throughput.

This paper presents an architecture of a hardware network packet generator designed for the COMBOv2 cards using the NetCOPE development platform. The packet generator internal structure allows synthetic IPv4 and IPv6 network packet creation as well as the real network packet transmission. Based on COMBOv2 add-on interface card, the generator is able to transmit packets at speed of 2×10 Gbit/s or 4×1 Gbit/s. Synthetic data are created using high quality pseudo-random number generator. If desired, previously captured network packets can be transmitted back to the network with exactly the same time drift as were captured. This is accomplished by extremely precise timestamps, which can be generated by the Timestamp Module included in the NetCOPE platform.