Scalable Heavy Hitter Detection: A DPDK-based

Kernel-Bypass Packet Processing using DPDK Bypassing the kernel is a solution to avoid kernel overheads and accelerate packet processing.
DPDK is a set of optimized libraries for processing packets in the user space while bypassing the kernel.
DPDK uses Poll Mode Drivers (PMD) which constantly poll the NICs for new packets to avoid overheads resulting from interrupts. 4<br>

Using P4 Programming for DPDK 5<br>

The P4-DPDK Workflow The system is implemented in P4 using the Portable NIC Architecture (PNA).
The P4 code consists of all packet processing functions, including customized code.
The p4c-dpdk compiler accepts the P4 code as input and generates a representation file (.spec file) that aligns with the DPDK software switch pipeline.
The DPDK pipeline runs on the CPU core of the host, bypassing the kernel.
The C code is compiled and a share object (.so) is generated. 6<br>

Core Affinity and Multicore Processing When a NIC receives a packet, it typically goes through a single CPU core for pipeline processing; this pipeline is often the application’s bottleneck.
Core affinity allows binding packet processing to a specific CPU core.
The NIC can distribute packets across multiple CPU cores using the Receive Side Scaling (RSS).
RSS uses hashing for load balancing. 7<br>

Methodology of the Work The Count-Min Sketch (CMS) algorithm is used to detect heavy hitters.
CMS uses multiple hash functions.
A hash function takes as input the 5-tuple, which is used to identify a flow.
The heavy hitter is detected by comparing the number of packets received from the flow recorded in the CMS against a predefined threshold. 8 D: Depth (# of hash functions)
W: With (# of flows)
i: Packet index, between 0-N
ki: ID of a flow, using ith packet info.
cd (ki ): estimated # of packets of flow ki, using hash function d, after processing packet i<br>

Experiment Topology The topology consists of three nodes, equipped with an NVIDIA ConnectX-6 NIC (100Gbps). Nodes are deployed on FABRIC1.
DPDK-pktgen2 is used to generate background and heavy-hitter traffic.
The heavy hitter traffic consists of packets belonging to the same flow while the background traffic is generated from a range of flows.
The detector should reflect background traffic and block traffic from heavy hitter. 9 I. Baldin et al., Fabric: A national-scale programmable experimental network infrastructure”, IEEE Internet Computing, Vol. 23, Issue 6, 2019.
https://pktgen-dpdk.readthedocs.io/en/latest/<br>

Performance Results of Heavy Hitter Detection Heavy hitter mitigation with 100Gbps background traffic.
The proposed system promptly detected and blocked the heavy hitter. Throughput as a function of the number of cores and packet size.
Increasing the number of cores increases the throughput at different packet sizes. 10<br>

Impact of the Number of Hash Functions Using 2 CPU Cores Accuracy of the CMS scheme depends on the number of hash functions.
Increasing the number of hash functions increases accuracy but decreases throughput.
Increasing the number of CPU cores mitigates the above performance penalty. Using 4 CPU Cores 11<br>

Heavy Hitter Detection with Replayed Real Traffic Data MAWI trace packet size distribution in four datasets populated on different dates.
All the packets were processed by the pipelines.
Heavy hitter mitigation while processing real traffic. 12<br>

Performance Comparison Against Suricata DPDK This experiment compares the performance of the proposed system against Suricata, an open-source Intrusion Detection System (IDS) / Intrusion Prevention System (IPS).
The proposed system produces higher performance than Suricata DPDK, which results on lower packet losses. 13<br>

Project Demo 14<br>

This paper presents a packet-processing scheme for end devices.
The scheme enables programmers to write applications using a high-level language (P4) and obtain high performance (DPDK).
Using a heavy hitter application as an example, the paper showcases features to help balance compromising resources:
Using CMS to reduce memory usage
Increasing accuracy by increasing the number of hash functions
Increasing throughput by using multiple CPU cores
P4-DPDK is one additional tool to achieve end-to-end programmability. Conclusion 15<br>

Cybertraining Material 16 Information about lab libraries is available at https://research.cec.sc.edu/cyberinfra/cybertraining
P4-DPDK Security (8 lab experiments, 200-page companion booklet)
Introduction to P4-DPDK (7 lab experiments, 172-page companion booklet)
P4-perfSONAR (8 lab experiments, 239-page companion booklet)
Cybersecurity Applications on P4 Programmable Data Planes
P4 Programmable Data Planes: Applications, Stateful Elements, Custom Packet Processing
Introduction to P4 Programmable Data Plane Switches
Introduction to P4 Programmable Data Plane Switches with Intel’s Tofino
Software-defined Networking (SDN)
Cybersecurity Fundamentals (19 lab experiments, 496-page companion booklet)
Zeek IDS/IPS
Network Management Tools
Network Tools and Protocols
perfSONAR 5
Introduction to IPv6
Introduction to OSPF
Introduction to BGP
MPLS and Advanced BGP
Open Virtual Switch
High-speed Networks: A Tutorial<br>

This work was supported by the U.S. National Science Foundation (NSF), under awards 2346726 and 2403360. The authors would also like to acknowledge the FABRIC team. Acknowledgement 17<br>

For additional information, please refer to
https://research.cec.sc.edu/cyberinfra/


Email: {choueiri, amazloum, ekfoury}@email.sc.edu, jcrichigno@cec.sc.edu 18<br>