Hardware vs. Software flow bypass in Suricata – Part 4

In last week’s blog post, we clearly showed that Suricata bypass software was overwhelmed with our mix of Internet traffic; the end result was a large percentage (about 45%) of dropped traffic. Dropped traffic is problematic for any application, but for security software it is the kiss of death. If you don’t process all traffic, how do you know that the traffic you dropped isn’t the one that contains the security vulnerability that is bringing down your network? The answer is, of course, you don’t know and this is simply unacceptable. It is for this reason that you need some hardware assist to make sure you process every last packet.  

In case you weren’t convinced from last week’s results, here is another view of the situation. The accompanying graphic shows CPU load for both test scenarios. For SW bypass (orange color) you can see that the CPU is pegged at 100% utilization right away. This is the reason that so much traffic is dropped because all CPU resources are exhausted. HW bypass on the other hand reaches a maximum CPU utilization of around 75%. This is important for at least two reasons: 1) The CPU is never overloaded so no security traffic is ever dropped and 2) There is some remaining spare CPU capacity which can be used for other critical tasks.

Want to learn more?

Host CPU Offload Product Features Summary
wdt_ID Speed 1G 10G 10G 10G 10G/40G 10G/40G 100G 100G 100G 100G
1 Model ANIC-4Ku ANIC-20Ku ANIC-40Ku ANIC-40Kq ANIC-80Ku ATLAS-1000 Platform ANIC-100Ku ANIC-200Ku ANIC- 200K Flex ANIC-200Kq
2 Port/Type 4 X 1G SFP 2 X 10GSFP+ 4 X 10GSFP+ 1 X 40G4 X 10GQSFP+ 2 X 40G8 X 10GQSFP+SFP+ 2 X 40GQSFP4 X 10GSFP+ 1 X 100GCFP4 2 x 100GCFP4 2 x 40G2 x 100GQSFP28 2 x 100GQSFP28
3 PCIe Interface Gen3 x8 Gen3 x8 Gen3 x8 Gen3 x8 Gen3 x8 Gen3 x8 Gen3 x16 Gen3 x16 Gen3 x16 Gen3 x16
4 Dimensions(H x L inches) 4.25 x 6.5   4.25 x 6.25 4.25 x 6.25 4.25 x 6.25 4.25 x 6.25 1.75 x12.28 x 14 4.25 x 10.5 4.25 x 10.5 4.25 x 6.5 4.25 x 10.5
5 Memory 32MB 4G 4G 4G 4G 16/32G 12G 12G 8G 12G
6 Timestamp 5.7 nS 5.7 nS 5.7 nS 5.7 nS 5.7 nS 5.7 nS 4 nS 4 nS 4 nS 4 nS
7 100% Packet
Capture
8 Gigamon,
Arista
Timestamp
9 Packet Merging
10 Packet Parsing

About Accolade

Accolade is the technology leader in FPGA-based Host CPU Offload and 100% Packet Capture PCIe NIC’s and Scalable 1U Platforms. Accolade’s line of 1-100GE products enable 100% packet capture, flow classification, flow shunting, deduplication, packet filtering and more. Our customers are global leaders in network monitoring & cybersecurity applications as well as in the network test and measurement, telecom and video stream monitoring markets.

FPGA Acceleration Features

100% Packet Capture | Flow Classification | Flow Shunting | Precise Time Stamping | Packet Merging | Packet Slicing | Packet Parsing | Packet Filtering | Deduplication | Host Packet Buffer | Packet Steering | Direct Memory Access (DMA) | Statistics (RMON1)

Free Product Evaluation

Resolve all your host CPU offload bottlenecks. Share Your Technical Requirements with our FPGA and software experts to tailor the optimal solution. Accolade offers a 60 day free product evaluation for qualified customers to fully test and evaluate our products.