Wire-Speed Statistical Classification of Network Traffic on Commodity Hardware
Résumé
In this paper we present a software-based traffic classification engine running on commodity multi-core hardware, able
to process in real-time aggregates of up to 14.2 Mpps over a
single 10 Gbps interface – i.e., the maximum possible packet
rate over a 10 Gbps Ethernet links given the minimum frame
size of 64 Bytes.
This significant advance with respect to the current state
of the art in terms of achieved classification rates are made
possible by: (i) the use of an improved network driver,
PacketShader, to efficiently move batches of packets from
the NIC to the main CPU; (ii) the use of lightweight statistical classification techniques exploiting the size of the first
few packets of every observed flow; (iii) a careful tuning
of critical parameters of the hardware environment and the
software application itself.