Architectural Impact of Stateful Networking Applications Javier Verdú, Jorge García Mario Nemirovsky, Mateo Valero The 1st Symposium on Architectures for Networking and Communications Systems Princeton, New Jersey, USA October 26-28, 2005 ANCS - I

Architectural Impact of Stateful Networking Applications2 Trends of Internet r Important growth of Internet Traffic r Consequent Traffic Aggregation increment Low packet/flow temporal locality r End-point routers & appliances execute stateful apps r Upper layer packet processing Larger workloads per packet r Facing new security issues r Improvement of attacks methods Need to spread the knowledge futher than a packet

Architectural Impact of Stateful Networking Applications3 Granularity Levels … Holding Company Department User Application Flow Packet Stateful Application Model Application - + State Lifetime Packet Flow User Company Department

Architectural Impact of Stateful Networking Applications4 Research Limitations on Stateful Apps r Pool of Benchmark Suites for Network Processors r CommBench r NetBench r NpBench r NPForum r Lack of Stateful Benchmarks r Most of them are stateless benchmarks r Creating new benchmarks r Reliability??? State size State management

Architectural Impact of Stateful Networking Applications5 Talk Outline r Introduction r Network Traffic Properties r Description of Environment r Architectural Impact Analysis r Summary

Architectural Impact of Stateful Networking Applications6 Network Traffic Properties r Traffic Aggregation Level r Unique Flow rate in a given window vs

Architectural Impact of Stateful Networking Applications7 Network Traffic Properties r Traffic Aggregation Level r Unique Flow rate in a given window r Intra-Flow Temporal Distribution r How the packets are exchanged? vs

Architectural Impact of Stateful Networking Applications8 Network Traffic Properties r Traffic Aggregation Level r Unique Flow rate in a given window r Intra-Flow Temporal Distribution r How the packets are exchanged? r Inter-Flow Temporal Distribution r Packet rate between packets of the same flow vs

Architectural Impact of Stateful Networking Applications9 r Snort is tuned with four different configurations r Stream4 Prevents Stick/Snot attacks r Flow-Portscan Detects portscanning attacks r SfPortscan Detects a variety of portscanning attacks r Merged Engines The combination of the above engines r Argus is a monitoring/billing benchmark r Currently it is included in NO benchmark suite r Open source application r Equivalent to the commercial tool Cisco NetFlow Benchmark Selection (I)

Architectural Impact of Stateful Networking Applications10 r Obviously, stateless applications keep no flowstate r The state size may vary a lot between applications r The state management also may be quite different Benchmark Selection (& II)

Architectural Impact of Stateful Networking Applications11 Evaluation Methodology r Instrumented Binary Code: ATOM r Trace-driven simulation: Modified version of SMTSim Simulator r Simulation length r Warming period 10K Packets r Processing period 50K Packets r Packet selection for the flow lifetime studies r Towards analysis of actual application behavior r The baseline is an ample configuration ROB Size 256 entries –No significant improvements with larger ROBs Physical Regs: 192 int, 192 FP –No stress due to lack of regs Perceptron Branch Predictor –The most powerful configuration 64KB I$, 64KB DL1$, 2MB L2$ –No significant improvements with larger caches

Architectural Impact of Stateful Networking Applications12 Architectural Impact Analysis r Computational complexity r Available Parallelism r Impact of Bottlenecks r Branch Prediction r Data Cache Behavior

Architectural Impact of Stateful Networking Applications13 Computational Complexity (I) r There are no significant differences among benchmarks r Roughly 35% - 45% of memory accesses r Argus is more memory intesive

Architectural Impact of Stateful Networking Applications14 Computational Complexity (& II) r The instruction mix is similar along all the packets r Some applications generate the hardest workload in the first packets r Other applications show almost constant workload

Architectural Impact of Stateful Networking Applications15 Available Parallelism r Processor configuration modified towards avoiding any constraint r The ILP is independent of the app category r It is inherent to the application itself r The evaluated apps show low ILP: ~3,7 IPC

Architectural Impact of Stateful Networking Applications16 Impact of Bottlenecks r Stateful apps show very lower performance r Roughly 0,6 IPC on average r The importance of the packet processing r Constant vs concentrated workload r Memory Impact r 3x – 19x of speed up

Architectural Impact of Stateful Networking Applications17 Branch Prediction (I) r High branch prediction accuracy on average r But we have two branch categories r Flow independent: similar among packets -> easy to predict r Flow dependent: flow related -> sensitive to traffic properties

Architectural Impact of Stateful Networking Applications18 Branch Prediction (& II) r A single active connection r Higher accuracy and no variations among n-th packets r High traffic aggregation level r Lower accuracy and vairations among n-th packets r Negative aliasign due to flow dependent branches r Most of our applications hide this effect due to concentrated workload No traffic aggregation levelHigh traffic aggregation level

Architectural Impact of Stateful Networking Applications19 Data Cache Behavior (I) r Stateful apps need reduced DL1$ to get steady miss rate r Taking advantage of flow independent memory references r Almost 100% of DL2$ accesses are misses r It is unable to keep the state of the active flows r Larger flow-states emphasize network properties impact r Getting higher steady state even with low traffic aggregation r The intra-flow distribution may be more helpful

Architectural Impact of Stateful Networking Applications20 Data Cache Behavior (& II) r Negative effects of the memory concentrated in the first packets r Constant workload applications show similar miss rate for every packet r Extra miss rates for data structures maintainance r Merged Engines from 1,5% to 5% on average

Architectural Impact of Stateful Networking Applications21 Summary (I) r We present the architectural impact of Stateful Networking Applications r An important new type of applications r The behavior along the packets of a TCP connection r Constant workload for the packets of a connection r Workload concentrated in the first packets of a connection r Analysis of network traffic properties r Branch prediction and data cache are sensitive to them

Architectural Impact of Stateful Networking Applications22 Summary (& II) r Reduced IPC on average r L2$ is unable to maintain the required states of active flows r Branch prediction also may improve once solved memory bottleneck r Other stateful applications may present different valuable results, but… r The critical bottlenecks even may be more stressed r Our concern is … r To have more sample applications to evaluate r To analyse the apps in a more realistic environment Running simultaneously a number of applications

Architectural Impact of Stateful Networking Applications23 Questions...

Architectural Impact of Stateful Networking Applications24 Traffic Traces r Filtered Traffic Trace r Bidirectional TCP connections r Generating Synthetic Traffic Traces r Mixing different traffic traces microTimestamp sorting based r We are assuming a set of traces with the same bandwidth link In our case: MRA link r Avoiding the aliasing of IP addresses among aggregated traces The set of traces are originally sanitized r The resulting traffic trace shows roughly 1Gbps r 170K active flows Achieved from the original OC12 MRA link ( 622Mbps)