Interrupt affinitization of multi-queue network interface cards is a fundamental composition that defines how packets from individual queue are processed by which CPU-cores on multi-core platforms. In this paper, we propose qcAffin to attain an optimal queue-to-core affinitization for packet processing systems based on a numerical cost model derived from hardware topology and runtime system workloads. Static architectural characteristics comprising the memory hierarchy and topology of hardware components are first analyzed to calculate static interrupt affinitization costs. Then we attempt dynamic interrupt affinitization to balance workloads on CPU-cores and improve overall performance. Classical networking applications ranging from bridging, routing, access control list (ACL) matching to deep packet inspection (DPI) with different frame sizes are extensively experimented to compare the performance of the proposed scheme and other existing approaches. As demonstrated in the comparison result, qcAffin achieves the similar performance of the best affinitization approach and outperforms the Linux default affinitizer by averages of 102, 278, 248 and 131 percent on 1G NICs for the four applications. On 10G NICs, dramatic boosts of 1,424 and 1,343 percent are measured for the bridging and routing applications, respectively. Moreover, the effectiveness of dynamic interrupt balancing is justified by a maximum of 150 percent higher system utilization and 1.2 Mpps more throughput compared to the fixed affinitization approach in a simulated setup of unbalanced traffic load.

As a result of continually changing Internet and applications, more and more advanced features are requested to be available in the appliance for more accurately monitoring and managing the network. Therefore, modern networking appliances are equipped with the DPI (Deep Packet Inspection) technology to scan the payload of a packet. A rule (like Snort rules) may consist of several patterns with certain relationships, such as order, relative positions, and offset, etc. The system performance is usually dominated by not only the pattern matching algorithm but also the rule match processing algorithm. This paper proposes a unique-pattern based pre-filtering method for the rule matching. It is employed to filter out unwanted matches after scanning the packet payload by the pattern matching algorithm. The proposed algorithm is also implemented on different multi-core platforms to demonstrate its efficiency and performance. The experimental results indicate that the throughput is improved significantly and can be increased approximately linearly to the number of CPU cores.

Interrupt affinitization of network interface cards (NICs) is a fundamental composition that defines how packets are processed by which CPU-cores on multi-core platforms. In this paper, we propose a simple port-configuration assisted scheme to attain an optimal affinitization for packet forwarding applications. Experiments ranging from bridging, routing, flow tracking to deep packet inspection are conducted to show the performance impacts utilizing different affinitization approaches. As a result, our proposed scheme achieves the same performance level as the best fixed affinitization scheme. In addition, the effectiveness of interrupt balancing is demonstrated for our scheme to be superior to the widely-deployed irqbalance with varying network settings.

Connection tracking by manipulating session tables is essential for stateful inspection capable applications such as stateful firewalls, network-based intrusion prevention systems (NIPS), traffic accounting and monitoring to process packets according to session state information. With the prevalence of multi-core computing, it is crucial to optimize the existing connection tracking structures and algorithms to fully utilize the underlying parallelism. In this paper, we propose a lock-controlled session table partitioning scheme accompanied with a dynamic resource balancing algorithm for session-aware multi-core networking systems. Experimental results show that the proposed scheme reduces the number of lock contentions to a maximum of 100 times less and, in turn, boosts the performance to 3.5 Gbps higher than the baseline. 100% resource utilization is also achieved by overcoming the constraint of fixed-sized partitioning.

To detect viruses, worms and, malware in the multi- gigabit environment, it is crucial for modern content-aware network security appliances to have a fast virus scanning scheme.Signature based multi- pattern matching algorithm is the core technology to enable fast virus scanning accurately and quickly. This paper proposes a multi-pattern matching algorithm with a simple shift/hash technique and a novel heuristic by inspecting overlaps between pairs of patterns to ensure both average and worst-case performance. Experimental results show that our algorithm performs 600 Mbps to 1.4 Gbps faster than the ClamAV AC and BM-based algorithms and achieves a maximum of 3.8 Gbps throughput in inline virus scanning while the memory consumption is nearly the same.