1. Hot Interconnects 20021 TCP-Splitter: A Reconfigurable Hardware Based TCP/IP Flow Monitor David V. Schuehler dvs1@arl.wustl.edu

2. Hot Interconnects 20022 Outline Motivation Hardware Platform Design Results Applications Questions

3. Hot Interconnects 20023 MOTIVATION

4. Hot Interconnects 20024 Problem Statement Develop a lightweight network monitoring component that operates at multi-gigabit/second line rates.

5. Hot Interconnects 20025 Why work with TCP? Over 85% on Internet traffic is TCP based Internet is growing TCP is a proven reliable transport for data delivery Provide high speed active networks the ability work with TCP flows

6. Hot Interconnects 20026 Why not use a software based monitor? Why not implement a full TCP stack ? Large memories required for reassembly Limited number of simultaneous connections Acts as a connection endpoint Not a lightweight solution Difficult to achieve desired performance

7. Hot Interconnects 20027 Solution Develop TCP flow monitor: TCP-Splitter Leverage existing hardware infrastructure Expand upon Layered Protocol Wrappers research

8. Hot Interconnects 20028 HARDWARE PLATFORM

9. Hot Interconnects 20029 Washington University Gigabit Switch

10. Hot Interconnects 200210 FPX Module Oscillators Static Ram NID (XCV600E) RAD (XCV1000E) PROM

11. Hot Interconnects 200211 DESIGN

12. Hot Interconnects 200212 Goals High Speed Design Small FPGA Footprint Simple Client Interface Support Large Number of Flows Utilize existing protocol wrapper framework Execute within FPX environment, and systems like it

13. Hot Interconnects 200213 Challenges Frames are dropped on the Internet Packets are reordering Flow state is needed for large number of flows Widescale deployment requires an efficient implementation Backbone networks must process data at multi-Gigabit/second rates Hardware library should be small

14. Hot Interconnects 200214 Assumptions/Limitations Though traffic may take diverse paths through a network, all monitored traffic must flow through the node with TCP-Splitter Through flows are generally bidirectional, data is processed as a pair of unidirectional flows Though data may be sent out of order, data will be forced to be processed in-order

15. Hot Interconnects 200215 TCP-Splitter

16. Hot Interconnects 200216 TCP Input Module Data Flow

17. Hot Interconnects 200217 Layout

18. Hot Interconnects 200218 Packet Routing Non-TCP packets  IP stack Invalid TCP checksum  Drop TCP SYN packets  IP stack (Seq # < Expected Seq #)  IP stack (Seq # > Expected Seq #)  Drop Else  Client App AND IP stack

19. Hot Interconnects 200219 Client Interface 1 bit Clock 1 bit Reset 32 bit Data Word 2 bit Data Enable 3 bit Start/End of Data Signals 2 bit Valid Data Bytes N bit Flow Identifier 2 bit Start/End of Flow Signals 1 bit TCA Client Application

20. Hot Interconnects 200220 RESULTS

21. Hot Interconnects 200221 Current State of Research Developed, simulated, and tested design Handles 256 k simultaneous flows Synthesizes at 101MHz Executes in hardware Developing new client applications

22. Hot Interconnects 200222 Synthesis Results for Xilinx XCV1000E-7 TCPSplitterFull Wrappers (Cell + Frame + IP + TCP + Client) Space/LUTs617 (2%)4954 (20%) Register bits503 (2%)4933 (20%) Processing delay7 clock cycles *44-68 clock cycles * * Plus length of packet in 32 bit words

23. Hot Interconnects 200223 APPLICATIONS

24. Hot Interconnects 200224 Sample Run Byte countSRAM write Flow ID Start of frame IP payload TCP data enable End of frame

25. Hot Interconnects 200225 Multi-Device Programmer Listens to TCP/IP conversation Extracts programming information Sends programming information to device Simultaneously programs multiple devices

26. Hot Interconnects 200226 Stacked programmer FPX Line Card 98 99 50 Client Server FPX 50

27. Hot Interconnects 200227 Conclusion A lightweight circuit, called TCP-Splitter, has been developed which provides a client application with the ability to monitor TCP/IP flows on multi- Gigabit/second networks.  Implemented in reconfigurable hardware  Operates on network traffic in real-time  Processes data at 3.1 Gigabits/second  Requires limited resources: 2% of a Xilinx XCV1000E  Eliminates the need for large reassembly buffers  Monitors 256 k flows simultaneously

28. Hot Interconnects 200228 Acknowledgments Harvey Ku  Multi-Device Programmer Dr. John Lockwood  Advisor

29. Hot Interconnects 200229 QUESTIONS