Endace DAG 9.2X2 - Extended Functions; Enhanced Packet Processing V2

To Next Page

To Previous Page

EDM01-36v10 DAG_9.2X2_Card_User_Guide - Introduction

Extended functions

Enhanced Packet Processing v2

With the Enhanced Packet Processing v2 capability the following types of enhanced capabilities can be

achieved:

1. Filtering: Filtering compares the fields in the packet's protocol headers to a list of user defined filter

rules. As a result, the packets matching the filter are tagged with a user defined color value. This

color value is subsequently used to steer the packet to specific stream buffer(s) or to drop the

packet.

2. Hash Load Balancing (HLB): The HLB module takes the packets and applies one of a number of

user selectable load balancing algorithms. This results in each packet being tagged with a bin

number. The bin number is used to help determine the stream the packets are sent to. The user can

choose the number of bins used in the packet tagging.

HLB is typically used to optimize the parallel processing done by multi-core servers, since each core

will only see a subset of the full traffic load. The user normally wants to distribute traffic equally (or

roughly equally) across the stream buffers while preserving "flow coherence", meaning, all packets

associated with a single TCP/IP session must always go to the same stream buffer. Hashing is the

tool used to classify the flow coherent streams and mathematically assign a "bin number" to each

packet. Bin numbers are then associated with specific stream buffers to achieve the desired load

balancing. The hashing algorithms are "flow coherent" so all packets that are a part of a particular

session will be tagged with the same bin number.

3. Steering: This is where the results of the previous steps are used to determine which stream the

packet should be steered to. Optionally, the interface / port number the packet originated from can

also be used in the steering process. The rules that determine how the packet steering is

accomplished are defined by the user. This gives a large amount of flexibility in the packet steering

process. The user can choose to use some, all or none of the color, HLB bin value and interface /

port numbers in the steering process.

4. Duplication: One of the unique benefits of the Steering feature is the ability to steer the same

packet to multiple streams. Packet duplication can simplify software architectures where different

applications need to process the same packet. For example, all traffic can be sent to stream buffer 0

for use by a capture to disk application, while only a subset of traffic is sent to stream buffer 2 for

handling by a traffic analysis application. For this document, packet duplication is defined as writing

a single packet into more than one stream buffer. It does not mean writing the packet twice into the

same stream buffer.

For further details refer to the following documents:

•

EDM04-30 dagfilter-loader Software Guide

•

EDM04-31 Enhanced Packet Processing v2

•

EDM04-35 dagcat-setup Software Guide v2