| Stream Reassembly is an important part for Deep Packet Inspection, which is an element of Network Intrusion Detection Systems and Network Forensic System. However, it has a serious memory wall problem because it needs to move packet payload from one block of memory to another.To break up this bottleneck, many researches have been done to improve the overall performance by using multi-core parallel processing architecture. However, some new issues are brought up, such as the competition for shared resources, the high-speed packet capture, and the load balancing of threads to cores, etc. To improve the performance of Stream Reassembly, the method based on multi-core Network Processor Unit has been studied deeply in this thesis. The contributions of this thesis are as followed:1. A multi-core NPU-based stream management system which makes full use of multi-core advantage is designed. This system enables NPU to manage and assemble sessions through adding a level of buffer to adjust the sequence of packets by using the multi-core NPU.2. A space-economical method for TCP stream reassembly is proposed in this thesis. When receiving a new packet, NPU will dispatch it and drop all the packet head, and then add a solid-size index data structures in front of the packet’s payload. Therefore, CPU only need to cache this data structures instead of the whole packet during stream reassembly, thus the memory usage of reassembly is largely reduced.3. Three optimistic techniques, namely Stream Table Dispatching, No-Locking Timeout, and Multi-channel Virtual Queue, are introduced in this thesis.4. A hardware solution, Stream Reassembly Card, is presented in this thesis for high-speed stream management. To address the critical role of memory size in SRC, the relationship between the throughput and memory size is analyzed intensively. Analysis shows that the reassembly can achieve more than 3 Gbps in terms of processing speed, and triply outperform the traditional server-based architecture. |
PDF Full Text Request