Scaling network packet processing performance to meet the increasing speed of network ports requires software programs to carefully leverage the network devices’ hardware features. This is a complex task for network programmers, who need to learn and deal with the heterogeneity of device architectures, and re-think their software to leverage them. In this paper we make first steps to reverse this design process, enabling the automatic generation of tailored hardware designs starting from a network packet processing program. We introduce eHDL, a high-level synthesis tool that automatically generates hardware pipelines from unmodified Linux’s eBPF/XDP programs. eHDL is designed to enable software developers to directly define and implement the hardware functions they need in the NIC. We prototype eHDL targeting a Xilinx Alveo U50 FPGA NIC, and evaluate it with a set of 5 eBPF/XDP programs. Our results show that the generated pipelines are efficient in terms of required hardware resources, using only 6.5%-13.3% of the FPGA, and always achieve the line rate forwarding throughput with about 1 microsecond of per-packet forwarding latency. Compared to other network-specific high-level synthesis tool, eHDL enables software programmers with no hardware expertise to describe stateful functions that operate on the entire packet data. Compared to alternative processor-based solutions that perform eBFP/XDP offloading to a NIC, eHDL provides 10-100x higher throughput.

The Segment Routing (SR) architecture is based on source routing. Within an SR enabled network, a list of instructions called segments can be added to the packet headers to influence the forwarding and the processing of the packets. In SRv6 (Segment Routing over IPv6 data plane) the segments are represented with IPv6 addresses, which are 16 bytes long. There are some SRv6 service scenarios that may require to carry a large number of segments in the IPv6 packet headers. Reducing the size of these overheads is useful to minimize the impact on MTU (Maximum Transfer Unit) and to enable SRv6 on legacy hardware devices with limited processing capabilities that could suffer from the long headers. In this paper we present the Micro SID solution for the efficient representation of segment identifiers. The proposed Micro SID solution has been implemented on three different architectures (VPP, Linux, P4) and interoperability tests have been performed. We also analyze the reduction of the header size that can be achieved with Micro SIDs and compare it with other proposals for segment list compression. Our results show that the header size can be reduced up to 75%. Finally, we mention that a fundamental asset of the proposed Micro SID solution is the full compatibility and seamless interoperability with existing SRv6 architecture.

The Segment Routing (SR) architecture is based on loose source routing. A list of instructions, called segments can be added to the packet headers, to influence the forwarding and the processing of the packets in an SR enabled network. In SRv6 (Segment Routing over IPv6 data plane) the segments are represented with IPv6 addresses, which are 16 bytes long. There are some SRv6 service scenarios that may require to carry a large number of segments in the IPv6 packet headers. Reducing the size of these overheads is useful to minimize the impact on MTU (Maximum Transfer Unit) and to enable SRv6 on legacy hardware devices with limited processing capabilities that could suffer the long headers. In this paper we present the Micro SID solution for the efficient representation of segment identifiers. With this solution, the length of the segment list can be drastically reduced.

Programmable dataplanes are emerging as a disruptive technology to implement network function virtualization in an SDN environment. This technology can be further enhanced by using data plane abstraction with stateful processing. In this paper we focus on real world use cases with stateful forwarding requirements to validate Open Packet Processor data plane abstraction. We first demonstrate the suitability of OPP for implementing complex stateful network functions by providing the detailed implementation of three use cases. Second, we assess the scalability of the use case implementations in the context of a datacenter deployment.

Stateful programmable dataplanes are emerging as a disruptive technology and an enabler factor for network function virtualization in SDN environments. In this demo paper we show three real world use cases with stateful forwarding requirements to validate both the hardware and software implementations of the Open Packet Processor data plane.

Many reasons make NFV an attractive paradigm for IT security: lowers costs, agile operations and better isolation as well as fast security updates, improved incident responses and better level of automation. On the other side, the network threats tend to be increasingly complex and distributed, implying huge traffic scale to be monitored and increasingly strict mitigation delay requirements. Considering the current trend of the networking and the requirements to counteract to the evolution of cyber-threats, it is expected that also network monitoring will move towards NFV based solutions. In this paper, we present D-StreaMon an NFV-capable distributed framework for network monitoring realized to face the above described challenges. It relies on the StreaMon platform, a solution for network monitoring originally designed for traditional middleboxes. An evolution path which migrates StreaMon from middleboxes to Virtual Network Functions (VNFs) has been realized.

Recently, with new hardware architectures such as Reconfigurable Match Tables and languages such as P4, the Software Defined Networking community has started to bring linerate data plane programmatic flexibility inside switching chipsets. Starting from the original OpenFlow's match/action abstraction, most of the work has so far focused on key improvements in matching flexibility. Conversely, the "action" part, i.e. the set of operations (such as encapsulation or header manipulation) performed on packets after the forwarding decision, has received way less attention: the OpenFlow community has limited to standardize the set of supported actions, whereas their implementation has been delegated to each specific vendor/device. Goal of this paper is to move beyond the idea of "atomic", pre-implemented, actions, and rather make them programmable while retaining high speed multi-gbps operation. In this work we propose a domain-specific HW architecture, called Packet Manipulation Processor (PMP), able to efficiently support microprograms implementing such actions. We describe three non trivial use cases (tunneling, NAT, and ARP reply generation), and assess the relevant throughput performance.

This paper presents a method to implement complex tasks into stateful SDN programmable dataplanes. In particular, the presented method proposes to use the internal microcontroller typically used to configure the programmable dataplane also to perform some complex operations that do not require to be executed on each packet. These operations can be executed on a set of data gathered by the dataplane and processed in a time scale that is much higher than the time window of a packet, but is much less than time scale needed for an external SDN controller. Moreover, the use of the configuration microcontroller instead of an external SDN controller to avoid the exchange of data on the control links permits a fine grain tuning of the operations to perform from the timing point of view (precise timestamping, low latency etc.). A set of measurements showing the feasibility of the method are presented, and a simple use case is described to show the effectiveness of this method to enhance the capability of stateful programmable dataplanes.

The fast evolving nature of modern cyber threats and network monitoring needs calls for new, “software-defined”, approaches to simplify and quicken programming and deployment of online (stream-based) traffic analysis functions. StreaMon is a carefully designed data-plane abstraction devised to scalably decouple the “programming logic” of a traffic analysis application (tracked states, features, anomaly conditions, etc.) from elementary primitives (counting and metering, matching, events generation, etc), efficiently pre-implemented in the probes, and used as common instruction set for supporting the desired logic. Multi-stage multi-step real-time tracking and detection algorithms are supported via the ability to deploy custom states, relevant state transitions, and associated monitoring actions and triggering conditions. Such a separation entails platform-independent, portable, online traffic analysis tasks written in a high level language, without requiring developers to access the monitoring device internals and program their custom monitoring logic via low level compiled languages (e.g., C, assembly, VHDL). We validate our design by developing a prototype and a set of simple (but functionally demanding) use-case applications and by testing them over real traffic traces.

This paper presents a hardware implementation of Openstate, an extension of OpenFlow that allows performing stateful control functionalities directly inside the switch, without requiring the intervention of an external controller. The paper shows how, with a minimal reworking of the OpenFlow's basic architecture, and reusing the same building blocks, it is possible to greatly extend the intelligence of an OpenFlow switch allowing the offload of many control task directly in the switch. An FPGA based implementation of an Openstate prototype is here presented, the different architectural design choices are discussed, and the performance and limitations of the developed prototype are examinated. Finally, the paper proposes a discussion on the performance achievable by using an ASIC implementation of the OpenState switch1.

In this paper, we provide the performance evaluation of the UPMT (Universal Per-application Mobility management using Tunnels) solution. UPMT offers per-application mobility management, i.e. the capability of separately taking handover decisions for each application. UPMT supports legacy applications, private IP addressing/NATs and it is an overlay solution that does not require the access network to offer any specific support. We have implemented UPMT under Linux OS and made it available under the GPL Open Source license.