A Modular System for FPGA-Based TCP Flow Processing in High-Speed Networks

Abstract

Abstract. Field Programmable Gate Arrays (FPGAs) can be used in Intrusion Prevention Systems (IPS) to inspect application data contained within network flows. An IPS operating on high-speed network traffic can be used to stop the propagation of Internet worms and to protect networks from Denial of Services (DoS) attacks. When used in the backbone of a core network, the device will be exposed to millions of active flows simultaneously. In order to protect the data in each connection, network devices will need to track the state of every flow. This must be done at multi-gigabit line rates without introducing significant delays. This paper describes a high performance TCP processing system called TCP-Processor which supports flow processing in high-speed networks utilizing multiple devices. This circuit provides stateful flow tracking, TCP stream reassembly, context storage, and flow manipulation services for applications which process TCP data streams. A simple client interface eases the complexities associated with processing TCP data streams. In addition, a set of encoding and decoding circuits has been developed which efficiently transports this interface between multiple FPGA devices. The circuit has been implemented in FPGA hardware and tested using live Internet traffic.

Tools for in-circuit testing of on-line content processing hardware

“…A photograph of the system is shown in Figure 2. One FPX performed Transmission Control Protocol/Internet Protocol (TCP/IP) processing of data [3], a second FPX implemented the student's content processing circuit, and a third FPX captured traffic. Three Gigabit Ethernet line cards were used: one sent and received traffic to the student PC located anywhere on the Internet, a second Gigabit Ethernet line card sent and received data to and from the content host, and a third Gigabit Ethernet line card monitored traffic statistics.…”

Next Generation Application-Aware Flow Monitoring

“…We will use this exporter to compare the results of the new system with existing flow monitoring solutions [2,20]. Since the flow monitoring is frequently used for high-speed network monitoring [12,17,24], we need to design our flow exporter to handle such speeds. The processing of application protocols makes this task even more challenging, since each packet needs to be analyzed more thoroughly to gain the necessary information.…”

Mutable codesign for embedded protocol processing

“…These engines can perform a variety of tasks, such as calculating checksums or handling segmentation and reassembly [8,9]. Earlier work has demonstrated full implementation of TCP/IP on platform FPGA based systems, including the use of offload engines combined with use of the embedded processor.…”