A Userspace Transport Stack Doesn't Have to Mean Losing Linux Processing
A Userspace Transport Stack Doesn't Have to Mean Losing Linux Processing
复制标题
DOI：
10.1109/nfv-sdn50289.2020.9289867
复制
发表时间：
2020-11
期刊：
影响因子：
--
通讯作者：
M. Abranches;Eric Keller
中科院分区：
文献类型：
--
作者：
M. Abranches;Eric Keller
虽然我们不能质疑内核旁路方法在网络功能领域的高性能，但我们认识到，Linux内核提供了一个具有高效资源管理和有效资源共享能力的丰富生态系统，这一点不容忽视。在这项工作中，我们认为，通过混合内核旁路和内核处理可以受益于应用程序和网络功能的中间盒。我们利用高性能用户空间TCP堆栈和最近添加到Linux内核中的内容，提出了一种混合方法（内核-用户空间），以利用可靠传输层的服务（即，有状态中间盒、第7层网络功能和应用）。我们的研究结果表明，这种方法可以实现高性能，高CPU效率，并增强与内核生态系统的集成。我们通过扩展mTCP来构建我们的解决方案，mTCP是一些最先进的L4-L7 NFV框架的基础。通过具有更高效的CPU使用率，NFV应用可以具有更多的CPU周期可用于运行网络功能和应用逻辑。我们表明，对于CPU密集的工作负载，mTCP/AF_XDP可以有高达64%以上的吞吐量比以前的实现。我们还表明，通过接收来自内核的合作，mTCP/AF_XDP使mTCP的保护机制的创建。我们创建了一个模拟的DDoS攻击，并表明mTCP/AF_XDP可以保持高达287%以上的吞吐量比未受保护的系统在攻击过程中。
While we cannot question the high performance capabilities of the kernel bypass approach in the network functions world, we recognize that the Linux kernel provides a rich ecosystem with an efficient resource management and an effective resource sharing ability that cannot be ignored. In this work we argue that by mixing kernel-bypass and in kernel processing can benefit applications and network function middleboxes. We leverage a high-performance user space TCP stack and recent additions to the Linux kernel to propose a hybrid approach (kernel-user space) to accelerate SDN/NFV deployments leveraging services of the reliable transport layer (i.e., stateful middleboxes, Layer 7 network functions and applications). Our results show that this approach enables highperformance, high CPU efficiency, and enhanced integration with the kernel ecosystem. We build our solution by extending mTCP which is the basis of some state-of-the-art L4-L7 NFV frameworks. By having more efficient CPU usage, NFV applications can have more CPU cycles available to run the network functions and applications logic. We show that for a CPU intense workload, mTCP/AF_XDP can have up to 64% more throughput than the previous implementation. We also show that by receiving cooperation from the kernel, mTCP/AF_XDP enables the creation of protection mechanisms for mTCP. We create a simulated DDoS attack and show that mTCP/AF_XDP can maintain up to 287% more throughput than the unprotected system during the attack.