A Modular System
for FPGA-Based TCP Flow Processing in High-Speed Networks
Abstract. Field
Programmable Gate Arrays (FPGAs) can be used in Intrusion
Prevention Systems (IPS) to inspect application data
contained within network flows. An IPS operating on high-speed
network traffic can be used to stop the propagation of
Internet worms and to protect networks from Denial of
Services (DoS) attacks. When used in the backbone of
a core network, the device will be exposed to millions
of active flows simultaneously. In order to protect the
data in each connection, network devices will need to
track the state of every flow. This must be done at multi-gigabit
line rates without introducing significant delays.
This
paper describes a high performance TCP processing system
called TCP-Processor which supports flow processing in
high-speed networks utilizing multiple devices. This circuit
provides stateful flow tracking, TCP stream reassembly,
context storage, and flow manipulation services for applications
which process TCP data streams. A simple client interface
eases the complexities associated with processing TCP data
streams. In addition, a set of encoding and decoding circuits
has been developed which efficiently transports this interface
between multiple FPGA devices. The circuit has been implemented
in FPGA hardware and tested using live Internet traffic.
Introduction. Including
reconfigurable networking technology within the core of
the Internet offers enhanced levels of service to users
of the network. New types of data processing services can
be applied to either all traffic traversing the network,
or to just a few selected flows.
This paper presents a modular
circuit design of a content processing system implemented
in FPGA hardware. A circuit has been built that reassembles
TCP/IP data packets into their respective byte streams at
multi-gigabit line rates. The implementation contains a large
per-flow state store which maintains 64 bytes of state information
per active flow and supports 8 million bidirectional TCP
flows concurrently.
The technology described
in this paper supports the coupling of other FPGAbased data
processing circuits in order to develop larger, more complex
processing systems. This technology enables a new generation
of network services to operate within the core of the Internet.
The remainder of this paper
is divided into the following sections. Section 2 provides
motivation for this work. Section 3 describes related work
on highperformance processing systems. Section 4 describes
the design of the system. Section 5 describes current results.
Section 6 outlines future work and section 7 provides concluding
statements.
|
