Hardware vs. Software flow bypass in Suricata – Part 3
In Accolade’s blog post two weeks ago, we discussed the chosen traffic mix for a test of Suricata bypass. The ultimate goal of the experiment was to compare the performance and efficacy of Suricata bypass using an ANIC-40Ku, FPGA-based adapter versus just software with no hardware assist. This week we will begin discussing the results.’
The accompanying graphic clearly shows the result of each scenario. The HW portion of the bar graph indicates that roughly 70% (light blue color) of the traffic was bypassed or shunted away. This is precisely the expected result with the remaining 30% (green color) of traffic being processed by Suricata. On the other hand, without the hardware assist, Suricata was simply not able to keep up with the deluge of data coming at it. The software managed to process a bit over 50% (green color) of the overall traffic (including the portion to be bypassed) but simply could not handle any more. The balance of the traffic (about 45%) was simply dropped (red color) because all available CPU resources were exhausted.
In next week’s blog we will dive further into the test results and what they mean. For those that want to read ahead, please reference this technical brief: