Existing research on Content Delivery Networks (CDNs) predominantly focuses on optimizing the delivery of hot content—popular items that attract frequent and repeated access from large user bases. However, at Meta, we have identified that cold content, which is less popular and accessed infrequently, poses significant challenges for user experience, especially with large volumes of direct messaging media. Through extensive analysis of Meta's CDN data, we quantify the impact of cold content performance on user experience and reveal substantial differences across geographic regions. Motivated by these findings, we propose CacheFlare, a suite of production-deployed solutions designed to enhance Quality of Experience (QoE) by increasing CDN hit rates for cold content. Through experiments and production validation, we show that even cold content can benefit from improved caching strategies, yielding up to a 10% improvement across a range of network performance metrics.

Packet classification is widely used as a core function for various applications in network infrastructure. With increasing demands in throughput, performing wire-speed packet classification has become challenging. Also the performance of today's packet classification solutions depends on the characteristics of rulesets. In this work, we propose a novel modular Bit-Vector (BV) based architecture to perform high-speed packet classification on Field Programmable Gate Array (FPGA). We introduce an algorithm named StrideBV and modularize the BV architecture to achieve better scalability than traditional BV methods. Further, we incorporate range search in our architecture to eliminate ruleset expansion caused by range-to-prefix conversion. The post place-and-route results of our implementation on a state-of-the-art FPGA show that the proposed architecture is able to operate at 100+ Gbps for minimum size packets while supporting large rulesets up to 28 K rules using only the on-chip memory resources. Our solution is ruleset-feature independent , i.e. the above performance can be guaranteed for any ruleset regardless the composition of the ruleset.

We present a routing table partitioning based solution for a high-performance IPv6 packet lookup engine on Field Programmable Gate Arrays (FPGAs). Based on the statistics collected from real-life backbone IPv6 routing tables, we propose a partitioning algorithm that creates both disjoint and balanced prefix groups. For each partition a range tree is built to perform IPv6 lookup. These range trees are mapped onto independent pipelines on FPGA such that for a single IPv6 lookup, only one partition is active. This yields high dynamic power efficiency via selective stage memory enabling. The balanced partitioning enables us to exploit the memory layout of the FPGA to align the pipeline with the on-chip memory blocks for enhanced performance and resource usage. Post place-and-route results on a state-of-the-art FPGA platform shows that a throughput of 200+ Gbps can be achieved for a 1 million entry IPv6 routing table.

The migration from IPv4 to IPv6 addressing is gradually taking place with the exhaustion of IPv4 address space. This requires the network infrastructure to have the capability to process and route IPv6 packets. However, with the increased complexity of the lookup operation and storage requirements, performing IPv6 lookup at wire-speed is challenging. In this work, we propose a high-performance IPv6 lookup engine solution for multi-core platforms that deliver state-of-the-art line card throughput rates. In order to exploit the parallelism offered on modern multi-core platforms, we propose a routing table partitioning scheme that forms disjoint and balanced partitions, given a IPv6 routing table. These partitions are represented as range trees to perform the lookup operation. Due to the disjoint nature of the proposed partitioning scheme, the individual range trees are able to operate independently, improving the parallelism of the lookup engine. Our experimental results on state-of-the-art multi-core processors show that throughputs of 100+ Gbps can be achieved for 2 million entry IPv6 routing tables using the proposed scheme. Compared with existing literature, the proposed solution achieves 10× higher throughput and is on par with performance delivered by hardware IP lookup engines.

The evolution of the Internet has transformed the simplistic Ethernet/IP based packet forwarding into a complex collection of lookup schemes. Depending on the location of the networking equipment (core, provider/customer edge, etc.,) a router/switch may potentially have to support several such complex lookup schemes. However, the hardware resources allocated to perform such operations are limited, especially in single chip implementations. In this paper, we propose techniques to map such complex lookup schemes on to hardware platforms under a limited resource budget and produce a design for a pipelined packet lookup architecture. An Integer Linear Programming (ILP) based technique is introduced to optimally allocate the limited hardware resources for a single lookup scheme. We extend our solution to multiple lookup schemes by proposing techniques to improve resource sharing, which results in a resource planning tool. Field Programmable Gate Array (FPGA) - a natural choice for high-speed packet processing applications - is used as the target platform. By using the proposed techniques, we show that up to 4 complex lookup schemes can be hosted on a single FPGA consuming only 20 Mbit on-chip memory and 750 pins for external memory communication.

Hardware firewalls act as the first line of defense in protecting networks against attacks. Packets are organized into flows based on a set of packet header fields and a predefined rule is applied on the packets in each flow to filter malicious network traffic. This is realized using packet classification, which is implemented in secure networking environments where mere best-effort delivery of packets is not adequate. Existing packet classification solutions are highly dependent on the properties (or features) of the ruleset. We present a bit vector based lookup scheme and a parallel hardware architecture that does not rely on ruleset features. A detailed performance analysis of the proposed scheme is given under different configurations. Post place-and-route results of our parallel pipelined architecture on a state-of-the-art Field Programmable Gate Array (FPGA) device shows that for real-life firewall rulesets, the proposed solution achieves 400G+ throughput. To the best of our knowledge, this is the first packet classification engine that achieves 400G+ rate on a single FPGA. Further, on the average we achieve 2.5× power efficiency compared with the state-of-the-art solutions.

Router virtualization has recently gained much interest in the research community. It allows multiple virtual router instances to run on a common physical router platform. The key metrics in designing network virtual routers are: (1) number of supported virtual router instances, (2) total number of prefixes, and (3) ability to quickly update the virtual table. Limited on-chip memory in FPGA leads to the need for memory-efficient merging algorithms. On the other hand, due to high frequency of combined updates from all the virtual routers, the merging algorithms must be highly efficient. Hence, the router must support quick updates. In this paper, we propose a simple merging algorithm whose performance is not sensitive to the number of routing tables considered. The performance solely depends on the total number of prefixes. We also propose a novel scalable, high-throughput linear pipeline architecture for IP-lookup that supports large virtual routing tables and quick non-blocking update. Using a state-of-the-art Field Programmable Gate Array (FPGA) along with external SRAM, the proposed architecture can support up to 16M IPv4 and 880K IPv6 prefixes. Our implementation shows a sustained through-put of 400 million lookups per second, even when external SRAM is used.

Recently, router virtualization has gained much interest in networking community. However, hardware support for router virtualization is still in its primitive stages. One of the major problems in a virtualized router is how to support frequent routing table updates efficiently, without interrupting network traffic. In this paper, we propose a Field Programmable Gate Array (FPGA) based architecture for router virtualization that supports on-the-fly updates, while ensuring scalability and throughput requirements. We introduce a distance-based mapping technique named Fill-In to merge multiple virtual routing tables into a single search tree. Node sharing is avoided by using a uniform data structure that results in a scalable solution for router virtualization. The reconfigurability and abundant parallelism of FPGAs make them a desirable hardware platform for high-performance and cost-effective routers. We leverage the features of modern FPGA devices to implement a parallel-linear-pipelined packet processing engine. Our post place-and route results show that the proposed architecture can support uninterrupted network traffic at 150 Gbps for minimum size (40 Byte) packets. The scalability of the architecture is demonstrated for up to 17 real routing tables. Using the proposed update techniques, our architecture handles an update with a single write bubble.

Network virtualization has become a powerful scheme to make efficient use of networking hardware. It allows multiple virtual networks to co-exist on the same physical networking substrate. This requires the hardware router to maintain multiple lookup tables. Hence, ultimately the hardware router should be capable of handling packets from different virtual networks. In this paper, we introduce a memory-efficient solution for router virtualization named, Multiroot. We propose this potential scheme for Provider Edge (PE) router virtualization after examining the address space requirement of such networks. Multiroot is a novel merging technique to consolidate all the routing tables to a single merged table. The shared data structure used in our algorithm results in a significant memory usage reduction in the lookup data structure while guaranteeing traffic isolation which is critical in a virtualized environment. This improvement in memory usage results in a very scalable solution for router virtualization in terms of resource usage of the hardware router. Multiroot uses trie data structure and can be implemented on a hardware or a software platform. Experiments show that our solution can achieve up to 5 fold memory usage reduction compared to state-of-the-art techniques present in literature.

We present an extensible automation framework for constructing and optimizing large-scale regular expression matching (REM) circuits on FPGA. Paralleling the technique used by software compilers, we divide our framework into two parts: a frontend that parses each PCRE-formatted regular expression (regex) into a modular non-deterministic finite automaton (RE-NFA), followed by a backend that generates the REM circuit design for a multi-pipeline architecture. With such organization, various pattern and circuit level optimizations can be applied to the frontend and backend, respectively. The multi-pipeline architecture utilizes both logic slices and on-chip BRAM for optimized character matching; in addition, it can be configured at compile-time to produce concurrent matching outputs from multiple RE-NFAs. Our framework prototype handles up to 64k "regular" regexes with arbitrary complexity and number of states, limited only by the hardware resources of the target device. Running on a commodity 2.3 GHz PC (AMD Opteron 1356), it takes less than a minute for the framework to convert ~1800 regexes used by the Snort IDS into RTL-level designs with optimized logic and memory usage. Such an automation framework could be invaluable to REM systems to update regex definitions with minimal human intervention.

The ossification of Internet infrastructure and protocols have hindered the advancement of itself. GENI, AKARI and several other similar initiatives are pushing forward to overcome this hindrance. They facilitate researchers with networking platforms dedicated for innovative networking experiments. In these virtualized platforms, researchers can define their own forwarding schemes which can be radically different from the existing solutions. However, neither researchers nor the vendors are endowed with benchmarks to evaluate their new schemes. In this paper we introduce a Flexible Rule Generator, FRuG, an entirely user controlled benchmarking tool for evaluating future packet forwarding algorithms. With FRuG, rule generation does not need to be restricted to a fixed number of fields anymore, which makes it highly generic. It allows the user to select the protocol fields and the distribution of each field, which can either be defined by the user or configured to follow the distribution of an input seed file. The user has the complete control over the structure and the size of the rule table which makes it a powerful benchmark to assess various packet forwarding algorithms and for different types of routers (ex. edge routers, core routers, etc.). FRuG consists of an IPv4 prefix analyzer and generator, MAC address analyzer and generator, and a generic rule generator. We believe that FRuG will be a very useful tool to the networking research community with the paradigm shifts in networking like network virtualization, which takes packet forwarding to a completely new level. FRuG is an opensource tool freely available at http://sites.google.com/site/thilangane/research.