Dpdk frame pipeline for ips ids suricata

1. DPDK Frame Pipeline for IPS-IDS Suricata

2. Introduction
Technological advancementin fixedand mobility sectorhasledtouse of smarterappliancesand
servicesfordayto day taskand chores.Withrise of demandin faster,mobile andlessgeographical
constraintworkplace; trafficcontenthasmovedfromprivate to publicdomainaccess.Sharingor
connectingtopublicdomainalso exposesthe system toattackson Webclientandserver
infrastructures.
Thisbringsin the needtomonitorthe trafficbothinboundandoutbound viaIDSor IPS at line rate.
Suricatais highperformance NetworkIDS,IPSandnetworkmonitoringsolution.Suricataisopensource
and have the followingattributeslike
 HighlyScalable
 Protocol Identification
 File IdentificationforMD5, Checksum&File Extraction.
Abstract
Thiswhite paperexaminesvarious changesand optimizationsonSuricataonvariouspacketsizes.
Currentdeploymentmakesuse of workerthreadmodel.
Issue
Suricataperformance isaffectedbythe followingforraw socket(AF)
1. Kernel version.
2. NICdriverand ASICversion.
3. CPU affinityandloadbalance fromyaml.
4. CPU speed,architecture andmemory.
5. Availabilityof packetstructure formillionsof frames.

3. Solution
To addressabove issuesfollowingideaswere developedfromgroundup
1. AddDPDK specificworkthreadtopoll the framesratherthan eventorinterruptcapture.
2. AllowDPDKmbuf zeropacketcopyto packetstructure.
3. Autoconfigure forinterface perspeed.
4. User optiontotriggerenable ordisable the use of DPDKworkerthreads.
Functional Walk Through
1. Added“--list-dpdkintel-ports, --dpdkintel“to“usage”and
2. AddedDPDKINTELto“SCPrintBuildInfo“
3. Added“TmModuleReceiveDpdkRegister,TmModuleDecodeDpdkRegister“to
RegisterAllModules“
4. DisabledsupportforPCAPif runmode isDPDKINTEL.
5. Addedrunmode “RUNMODE_LIST_DPDKINTEL_PORTS“viaListDpdkIntelPorts
6. Executedinmain
a. dpdkEalInit
b. ParseDpdkConfig
c. validateMap
d. dpdkConfSetup
e. launchDpdkFrameParser
f. rte_eal_mp_wait_lcore
Design 1
Receive trafficfrominterfaceisrunonthe PacketAcquireLoopfunctionof Suricata.There are no
dedicatedthreadstohandle trafficfromthe Interfaces.Schedulingof workerthreadsfetchespackets
fromthe PMD interfacesinuserspace.

4. Design 2
Receive trafficfrominterfaceisrunondedicatedDPDKlcore.The packetsare forwardedonto
PacketAcquireLoopfunctionviaRingBuffer.Thisisclose topipeline modeling;exceptthe receiving
threaddoesnot runon same core viapacketaffinity(YAMLconfiguration).Schedulingof workerthreads
fetchespacketsbydequeuingthe ringbufferassociatedtoworkerthreadinuserspace.
Design 3
Total workerthreads,CPUaffinitywithavailablespare coresare calculatedtocheck;if enoughnumber
of coresare presenttodpdkIntel Receivetrafficfrominterface isrunondedicatedDPDKlcore.The
packetsare forwardedontoPacketAcquireLoopfunctionviaRingBuffer.Thisisclose topipeline
modeling;exceptthe receivingthreaddoesnotrunon same core viapacketaffinity(YAML
configuration).Schedulingof workerthreadsfetchespacketsbydequeuingthe ringbufferassociatedto
workerthreadinuserspace.
Design 4
Similartodesign3,exceptforDPDK core assignedtoper pair(intf 1 and intef2) ratherthanindividual
lcore for processingreceivedtraffic.Thiscanbe furtherconfiguredforall interface touse same RXlcore
or per pairuse round robintofetchtraffic.
Followingare couple of validationdoneinbackground
1. Checkfor LinkspeedsetupforIPSpairs.
2. Fetchthe CPU affinityforSuricata
3. Crosscheck if CPU availabilitywithIntelCoresforDPDK.
4. Assign1 DPDK core for 10 and 100 MB interface forIPS|IDS|BYPASS.
5. Assign1 DPDK core for 10G interfaces.
Application

5. Future Roadmap
 Optimize formulti threadworkerspercore.
 Allocate Deallocate“structpkt”usingmbuff private sector.
 Pre parse frame toaccelerate Decode logic.
 ACL rule match accelerate usingHuge page andHash IndexedACL.
Conclusion
UtilizingsingleDPDKworkerthread andoptimizationtechniquesspecifictothe probleminhand;we
were able toaccelerate IDS-IPSprocessingof Suricataworkerthreadsaround70% and more.