Andreas Kind, Roman Pletka

and Marcel Waldvogel

The Role of Network Processors
In Active Networks

Overview

Network Processor programmability

Applications of NPs

Advantages of NP-based ANs

Our new NP-based AN framework

Requirements

Safety hierarchy

Implementation experience

Conclusion and outlook

Network Processor Programmability

Horizontally layered software architecture

–	NP instruction set on the lowest layer provides means for packet handling.

–	NP APIs (www.npforum.org) and protocols (IETF ForCES) dedicated to data-plane, control-plane, and management plane services.

Ingress

Switch Fabric

Network

Processor

Egress

Control

Processor

Data

Control

Mngmnt

Node Services APIs

Network Services APIs

Appl

Network

Appl

Applications of NPs

Content switching and load balancing

Transparently distributing client requests across different servers.

Traffic differentiation

QoS and traffic engineering require differentiation based on classification, policing, and forwarding functions at edge and core routers leading to increased data-plane processing.

Network security

Security functions for protecting systems and networks such as encryption, intrusion detection, and firewalling.

Terminal mobility

NP help mobile IP equipment manufacturers to adjust their products fast to evolving protocols in mobile IP convergence.

Active networking

ANs require significantly more data-plane processing and require routers to expose their state of operation in order to allow reconfiguration of forwarding functions.

Advantages of NP-based ANs

Key idea in AN: Decouple network services from the networking infrastructure by use of active packets and active nodes.

Historically, despite of innovative ideas ANs never were widely deployed in production networks. Network equipment manufacturers as well as network operators believed ANs have a negative inpact on efficiency in packet processing.

The interpretation of byte-coded active programs come with additional processing overhead which can not be provided in routers using ASICs or FPGAs.

With the advent of network processors ANs get an upcurrent that builds a feasible technical solution in the ever changing and increasing requirements (e.g., new protocols, standards …).

In addition, ANs profit from recent safety and security advances which are practicable using network processors.

Requirements

Safe byte-code language

Architectural neutrality, provides intrinsic safety properties (bounds on CPU, memory, and networking bandwidth => SNAP).

Resource bound

Bound in 2 dimensions:
per-node resources and the number of nodes/links the packet will visit.

Safety levels

Definition of a safety hierarchy in order to monitor control-plane and data-plane activities.

Sandbox environment

Any active code is executed in a safe environment called the active networking sandbox (ANSB).

Router services

Dynamically enhance router functionality to overcome limitations of the byte-code language.

Static router services are defined as opcodes in the byte-code language (e.g., IP address lookup, interface enumeration, flow queue management, or congestion status information).

Dynamic router services tailored to networking tasks with a focus on control-plane functionality (e.g., AQM, scheduling, policing).

Routing

Active packets will not interfere with routing protocols. Alternative routes are possible as long as defined in the local forwarding table.

Safety hierarchy for ANs

Dynamic router services:

registering new router

services

Authentication of active packets

needed using public key

infrastructure.

Complex policy insertion

and manipulation

Simple policy modification

and manipulation

Creation of new packets

and resource-intensive router

services (e.g., lookups)

Simple packet byte-code

Admission control at the edge of the

network, trusted within a domain.

Running in a sandbox environment,

limited by predefined rules and

installed router services.

Sandbox environment based on the

knowledge of the instruction

performance.

Safety issues solved by restrictions

in the language definition and the

use of a sandbox environment.

No active code present

in packets

Corresponds to the traditional packet forwarding process

in IP networks.

0

1

2

3

4

5

Safety

Level

AN Models on Network Processors

Host

Processor

embedded GPP

Data path
forwarding engines

Traditional model

Data path
forwarding engines

The offloading model

Host

Processor

embedded GPP

NP

NP

Architectural Overview

Layer 2

Layer 3

Layer 4

Routing

AN Code

Handler

Policer

Classification

AQM

Scheduler

PCI-X-to-Ethernet Bridge

EPC-to-ePPC Interface

Proxy Device Driver

Device Driver

Routing

Table

Netlink

NPDD

NPCP

Resource

Manager

TC

External attached CP

IP Stack

IP Stack

NPDD

ANSB

Control Elements

Kernel Space

User Space

ePPC (NP)

Forwarding Elements

NP

Routing

Protocols

Ingress Data-path processing on NPs

Physical Layer Devices

L2 Processing

Ingress

Active Networking

Code Handler

Frame Size

Dst MAC Address

Hdr Checksum

Unicast/Multicast

Start IP Lookup

Ingress Counter

TTL Test

IP Options

L4 Processing ?

L3 Processing

L4 Processing

Ingress

Flow

Control

(RED, BAT, ...)

L4 Classification

Switch Interface

Egress Data-path processing on NPs

L3 Processing

Egress

Active Networking

Code Handler

EPCT Lookup

Port Type (Enet)

Enet Encapsulation

Enqueue

ARP Table Lookup

opt. VLAN Tag

DSCP Remark

Fragmentation

Egress Counter

L2 Processing

Scheduler

Egress

Flow

Control

(RED, BAT, …)

Switch Interface

Physical Layer Devices

0

2047

0

39

Flow

Queues

Port

Queues

Combined WFQ

and Priority

Scheduler

Conclusion & Outlook

NPs in ANs booster flexibility without compromising neither performance nor safety.

In general and in the context of the proposed AN framework the deployment of ANs can benefit from NP technology and hence simplify the development of new services.

Security and safety advantages result from a combination of stringent requirements.

Offloading of active code from the control point to the NP’s GPP
=> additional physical barrier between packet-processing cores and the ePPC on the NP.

Slide 1

IBM Presentation System

W.Bux

2003-07-24T09:49:04

Marcel Waldvogel