Introducing SmartNICs in Server-Based Data Plane Processing: The DDoS Mitigation Use Case

Abstract

In the recent years, the complexity of the network data plane and their requirements in terms of agility has increased significantly, with many network functions now implemented in software and executed directly in datacenter servers. To avoid bottlenecks and to keep up with the ever increasing network speeds, recent approaches propose to move the software packet processing in kernel space using technologies such as eBPF/XDP, or to offload (part of it) in specialized hardware, the so called SmartNICs. This paper aims at guiding the reader through the intricacies of the above mentioned technologies, leveraging SmartNICs to build a more efficient processing pipeline and providing concrete insights on their usage for a specific use case, namely, the mitigation of Distributed Denial of Service (DDoS) attacks. In particular, we enhance the mitigation capabilities of edge servers by transparently offloading a portion of DDoS mitigation rules in the SmartNIC, thus achieving a balanced combination of the XDP flexibility in operating traffic sampling and aggregation in the kernel, with the performance of hardware-based filtering. We evaluate the performance in different combinations of host and SmartNIC-based mitigation, showing that offloading part of the DDoS network function in the SmartNIC can indeed optimize the packet processing but only if combined with additional processing on the host kernel space.

Lucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection

“…However, in contrast to cloud highperformance servers, edge nodes cannot exploit sophisticated solutions against DDoS attacks, due to their limited computing and memory resources. Although recent research efforts have demonstrated that the mitigation of DDoS attacks is feasible even by means of commodity computers [72], [73], edge computing-based DDoS detection is still at an early stage.…”

Hybrid SDN evolution: A comprehensive survey of the state-of-the-art

“…The virtualization overhead, the utilization level of the servers and the techniques adopted to implement the VSNFs are the most significant contributors to the performance degradation. To mitigate the problem, recent approaches propose to either adopt kernel bypass technologies such as the Data Plane Development Kit (DPDK) [122], Netmap [123] or Vectorized Packet Processing (VPP) [124], or to move the software packet processing in kernel space using eBPF/XDP [125].…”

Analysis of Linux Os Security Tools for Packet Filtering and Processing

“…eBPF programs can be attached even before packet enter PREROUTING chain of Netfilter. eBPF based program XDP provides possibility to process packets before TCP/IP stack achieving higher performance of packet processing (Miano et al, 2019b). Location of Netfilter's chains, most popular tables and eBPF hooks are shown in Figure 1.…”