Practical Chip Design

Jun 24 2008 12:00AM | Permalink | Email this | Comments (0) |
Blog This! using:  Blogger.com | LiveJournal |
Digg This | Slashdot This | add to Del.icio.us

One of the most valuable applications for Tarari's regular expression processor technology has been deep packet inspection. Tarari's hardware, available in FPGA, ASIC, or silicon IP form, in effect applies a large set of regular expressions (browse here, if you are curious) in parallel against a stream of data. Along with more arcane uses such as parsing XML at wire speed, a hardware regular expression processor is very handy at exploring the payloads of IP packets to classify the contents. For this reason, the company was an appealing acquisition for the network hardware group at the newly reorganized LSI.

LSI not only assisted Tarari in getting their T10 processing core into multicore ASICs, but has broadened the exposure of the technology in the networking world. With the introduction of a set of board containing up to four T-1000 quad-core processors and handling up to 12 Gbits/s data rates, LSI is offering to make Tarari technology a plug-in option for a wide range of routers.

In the process, the company is uncovering some very interesting information on patterns of use for deep-packet inspection. John Bromhead, product marketing manager at LSI/Tarari, said that the company is seeing strong interest from two categories of users: service providers and enterprise network administrators. The two both need high throughput, Bromhead notes, but in some ways they have very different needs.

Service providers, Bromhead explains, are primarily interested in categorizing packet payloads in order to manage quality of service. They want to know if the packet contains contracted data, streaming video, VOIP, low-bandwidth data, or whatever. Once the inspection can determine the nature of the payload, it can skip to the next packet. This allows service providers to get significantly higher throughput from a given bandwidth of inspection engine, since the inspection rarely has to scan every Byte in a packet.

Enterprise network managers, on the other hand, are primarily concerned with security, Bromhead says. They are on the watch for unacceptable content, and especially for fragments that could indicate a virus. That means they must both match against a wider variety of expressions and look at every Byte of every packet. So at the same wire speed enterprise managers may completely saturate a hardware engine that a service provider would not particularly stress.

This became apparent, Bromhead says, when LSI was working on the load-balancing software that manages traffic through the T10 cores on the new multi-chip boards. In some cases, it makes sense to split the packet stream into two or four flows and send each one to a separate chip. In other cases, it makes sense to replicate the stream, and send it to several chips in parallel, with each chip evaluating a different set of regular expressions. In still other cases, only adding more chips will meet the bandwidth needs.

More than a reflection of Tarari's specific architecture, the multicore data flow problem for deep packet inspection will be similar across a range of different hardware and software solutions. It is interesting in itself, and it illustrates the complexity of substituting parallel execution for raw speed across a range of applications.

Related entries in: Broadband | Network processors | SOC (System on a chip) |