Cloud Native Computing Foundation KubeCon + CloudNativeCon China 2019 (Shanghai), 5 Jul 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Flow-based Packet Processing Framework on DPDK and VPP - Hongjun Ni, Intel

Description

Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io

Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects

Flow-based Packet Processing Framework on DPDK and VPP - Hongjun Ni, Intel

Traditionally, many networking data plane processing is based on packets, which leads to some real issues: not sharing states, not guaranteeing packets order, etc. This talk will introduce a flow-based packet processing framework based on DPDK and VPP. It shows high performance, guarantees packet order, shares state among features and keeps flexibility. It can be applied on 5G and SD-WAN cases. It contains below key elements: 1) Implement a centralized and generalized flow infrastructure. 2) Implement a Hardware flow offloading feature in NIC, improving performance of classifying flows. 3) Implement a Software flow mechanism when configured flow entries exceed the limit of Hardware NIC. 4) Support Bridge-domain Aware and VRF Aware flow processing. 5) Support Policy-based Routing, and Tunnel Offloading Processing. 6) Support One flow maps to many NICs, and one NIC contains many flows.

https://sched.co/Nrth

A

B

Talk about basic process framework on tippity k and so.

B

We combine all these together now to.

B

Previously there were two presenters.

A

B

I'd like to thank all the deputy k, immunity and also my colleagues from Intel like John Ray Wang Zhang, is a team leader.

A

Or the project leader.

B

Jeremy tallit from Cisco and Dave Farra Cole specializes on.

A

B

We're doing trouble pain and they apply this technology to 5g.

B

The flow base to solution.

A

B

Overall picture.

A

B

I will introduce in detail different aspects of this solution. For example, the hover.

A

Offload and super slow process hyper.

B

C

First, why.

B

Should we realize this no based framework.

B

A

B

You find that this problem is actually be resolved separately.

A

B

Cannot guarantee the orders off packets having.

A

A specific rule.

A

B

We cannot share the status among.

D

B

B

Because you cannot assure the status, also, some actions may be duplicate or we don't.

A

B

As the packet header, cash value and.

A

B

Need to calculate for multiple.

A

B

This will occupy the CPU resources.

B

And based on the scenario or this kind of problem, we have to forward this flow banks.

A

A

B

Have two ways where these: how we're uploading the other is through so.

A

B

Have two ways of flow configuration? One is static. The.

A

Other is dynamic.

A

B

Intel UK way, they also support flow direction.

B

No matter by how.

A

Finally, you have this flow.

B

Id I feel are: they will be used to process the middle procedures.

A

B

Example, identify the.

B

Use the flow ID to analyze, effective.

A

B

Is to deploy flow.

A

B

A

B

Those with encrypted.

A

B

Colleague, there's also training the network model by intelligence.

A

A

B

Dpr or their work intelligence to identify the application activities, as are at layer, seven.

A

B

Example in Richard, you might send a text message or voice message or a video. You can use this to I.

A

B

You're sending.

B

Based on the location, based on its role and also is choice of fruit.

A

B

With seven one, seven one phone, it.

D

A

Or how there are resources, and it's more.

B

A

B

We can identify the bridge domain information than by house ready, diverge.

A

B

Will come to flow ID.

A

B

Times then that will have this pragmatic.

B

We can configure it. State goes with five temple and we aren't.

A

B

We can supports both ipv4 and ipv6 fields.

A

B

Need to first try how we're upload to a nice view based on the view detail.

B

So first we try they how we're uploading.

A

B

A

B

So then we need to create the software flow mappings.

B

Bi-Directional flow so each developer a to aware of software flow, but both flow meetings will be mapped to the same.

A

B

For our flow of loans, we use the RTD flow mechanism from TPP K. Now we have ipv4 trouble and ipv6 table ipv6 be excellent and a v6.

A

B

B

Flow ID will be created.

A

B

Then we'll create this fluidity in the packet description.

A

B

However, 13 felt that will stick to a software.

A

B

Have the RSS mechanism which can be utilized and it supports the.

A

B

We need to click it at the hash value and.

A

B

Look up the software flow table matched. Then we need to set the flow ID to the metadata I.

A

B

To talk about the relationship between the next and flows so on the left.

A

B

Flow is mapping to many I and.

A

B

The right, what a nice it contains, many fills.

A

B

Is free domain and.

A

B

There are multiple clients, users or enterprises.

A

B

They share the same couple, maybe their example: destination address and the AP are the same.

A

B

Maybe their ID is different than we need to identify them at different rooms.

B

If having, for example, the same five temporal packets matching on two different or even on two different interfaces, they should be created with different flows.

B

Which is talked about a flow framework quieting the DPI process.

A

B

Matter is dpi or its network intelligence. The process is quite similar.

A

B

I mentioned with duda we're uploading match, and then the packets will be redirected to a dpi cookie with a flow. If it doesn't match the packets will be bypassed so dpi plucky and.

B

Now we need to look up the software, though.

A

B

Need to achieve it now we need to track that he said being at the 3-way, for example. First, we need to track the handshake. We need to ensure the connection is affected and also it's bi-directional.

A

B

We need to identify the traffic direction, whether it's to the client end or.

A

The other way around then.

B

We need to track the TCP sub sequence and also it acts sequence than we need to.

B

For example, rain would occur, they will expire. The flow.

A

B

Important thing is to define, instead of based on the left.

B

You can see the data structure.

A

B

Also, the matching.

B

Cross bonding application, name and application.

A

B

Name for the situation first example: it.

B

Tells you the rules.

A

B

How the header scanner works.

A

B

Are two major parts.

A

B

The left, you need to match some rules and then you need to define your block mode. Then you need to do the orchestration and.

B

We will allocate a scratch for each.

C

Useful information so he's captured and identified.

A

C

Feature on the right: it's this thing.

A

C

Captured on the internet.

C

702 whispers.

A

C

That's the summary.

A

C

A

C

Work so it's a flexible hardware, uploading.

C

Hyper screen mode.

A

C

Much does it occupy for one more or two.

A

C

Is precise matching.

C

And I see I didn't see any performance test data.

C

It's fine only down to a her scam.

C

Performance can be tested through a test of heart span.

A

C

Can realize the 10,000 streams running simultaneously.

C

Is not easy to detect, but.

A

C

Open source software's can generate the statements.

A

C

A

C

Clients have already been using it.

A

C

You just mentioned that if the heart were close, then we were tasting software.

A

C

We will add dynamic establishment.

A

C

The hardware matching failed and we will add software.

A

C

The next stream comes, it will first match with the hardware and then to software. How.

A

Do you know it was successful.

A

C

If the hardware it does not go.

A

A

C

I will check the flow ID if it is valid.

C

Have different tonight we are at.

A

C

Journal will have different and I see. There is a list giving all the information who are different, a nice dance or is on software.

A

B

Think for the first award before the inner court.

B

Well, would you face about.

A

B

We think the process that we need to read it and also, for example, Oh for five minutes. But there is no connection that we need.

B

Frankly, we can discuss other questions, offline.