Hardware vs. Software flow bypass in Suricata – Part 3

In Accolade’s blog post two weeks ago, we discussed the chosen traffic mix for a test of Suricata bypass. The ultimate goal of the experiment was to compare the performance and efficacy of Suricata bypass using an ANIC-40Ku, FPGA-based adapter versus just software with no hardware assist. This week we will begin discussing the results.’

The accompanying graphic clearly shows the result of each scenario. The HW portion of the bar graph indicates that roughly 70% (light blue color) of the traffic was bypassed or shunted away. This is precisely the expected result with the remaining 30% (green color) of traffic being processed by Suricata. On the other hand, without the hardware assist, Suricata was simply not able to keep up with the deluge of data coming at it. The software managed to process a bit over 50% (green color) of the overall traffic (including the portion to be bypassed) but simply could not handle any more. The balance of the traffic (about 45%) was simply dropped (red color) because all available CPU resources were exhausted.

In next week’s blog we will dive further into the test results and what they mean. For those that want to read ahead, please reference this technical brief:

[Tech Brief] Download Shunt Away Unwanted Suricata Traffic

Want to learn more?

Host CPU Offload Product Features Summary

wdt_ID Speed 1G 10G 10G 10G 10G/40G 10G/40G 100G 100G 100G
1 Model 4Ku 20ku 40ku 40kq 80ku ATLAS-1100 Service Node ANIC-200KFlex ANIC-100Kq ANIC-200Kq
2 Port/Type 4X1G SFP 2X10G SFP+ 4X10G SFP+ 1X40G QSFP+ 4X10G SFP+ 2X40G QSFP+ 8X10G SFP+ 4x10G SFP+ 1x40G QSFP+ 2x100G QSFP28 2x40G QSFP28 1X100G QSFP28 2X100G QSFP28
3 PCIe Interface Gen3 x8 Gen3 x8 Gen3 x8 Gen3 x8 Gen3 x8 Gen3 x8 Gen3 x16 Gen3 x16 Gen3 x16
4 Dimensions(H x L inches) 4.25 x 6.5   4.25 x 6.25 4.25 x 6.25 4.25 x 6.25 4.25 x 6.25 1.75 x12.28x14 4.25 x 6.5 4.25 x 10.5 4.25 x 10.5
5 Memory 32MB 4G 4G 4G 4G 16/32G 8G 12G 12G
6 Timestamp 5.7 nS 5.7 nS 5.7 nS 5.7 nS 5.7 nS 5.7 nS 4 nS 4 nS 4 nS
7 100% Packet
Capture		 ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
8 Gigamon, AristaTimestamp ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
9 Packet Merging ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
10 Packet Parsing ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓

About Accolade

Accolade is the technology leader in FPGA-based Host CPU Offload and 100% Packet Capture PCIe NIC’s and Scalable 1U Platforms. Accolade’s line of 1-100GE products enable 100% packet capture, flow classification, flow shunting, deduplication, packet filtering and more. Our customers are global leaders in network monitoring & cybersecurity applications as well as in the network test and measurement, telecom and video stream monitoring markets.

FPGA Acceleration Features

100% Packet Capture | Flow Classification | Flow Shunting | Precise Time Stamping | Packet Merging | Packet Slicing | Packet Parsing | Packet Filtering | Deduplication | Host Packet Buffer | Packet Steering | Direct Memory Access (DMA) | Statistics (RMON1)

Free Product Evaluation

Resolve all your host CPU offload bottlenecks. Share Your Technical Requirements with our FPGA and software experts to tailor the optimal solution. Accolade offers a 60 day free product evaluation for qualified customers to fully test and evaluate our products.