integrate FPGA\PF_RING supported NIC with Bro - offload

Hi all,

I wonder if anyone had a chance of somehow incorporate a FPGA NIC \ Smart NIC \ Napatech \ PF_RING with Bro ?

I would like to scale my Bro cluster and process higher volumes of traffic (5-10Gbps). Currently I use PF_RING supported nic (intel X710) to LB the traffic to multiple workers - this environment cannot handle the above traffic load.
I could always beef up my server but that does not seem like an elegant solution.

Could there be any benefits for moving to Napatech NIC or FPGA supported NIC ?
In what scenario an FPGA card can be integrated with Bro to offload some of its more tedious tasks to the smart nic ?

Any ideas would be appreciated
Thanks
B

X520 and X710 can handle that easily, with afpacket. No need for pfring, it would not even come close to 10Gbit anyway.

Which distribution do you have to use?

I use Bro 2.5, ubuntu server 16.04, PF_RING 6.6

So af_packet will speed up the packet source \ IO loop part of Bro more than PF_RING ?
After reading about it they seem to provide roughly the same output in terms of speed.

It still seems like speeding up the reading of network traffic to Bro can get you so far, no other ways of taking some of Bro’s processing and offload them to a network card\ FPGA card ?

Thanks

There aren't any code paths in Bro that offload work into any specialized NICs. It's fairly hard to find the exact right abstraction that would provide some benefit to Bro and still be technically achievable.

   .Seth

Hi,

> It still seems like speeding up the reading of network traffic to Bro
> can get you so far, no other ways of taking some of Bro's processing
> and offload them to a network card\ FPGA card ?

There aren't any code paths in Bro that offload work into any
specialized NICs. It's fairly hard to find the exact right abstraction
that would provide some benefit to Bro and still be technically
achievable.

to add a bit to this - while there currently is no support (at all) to
offload work into specialized NICs, this actually is one of our research
projects.

Our ideas and plans have been documented in a short paper - if you are
interested you can take a look here: http://icir.org/johanna/papers/sdnfvsec17codesign.pdf

If you have any ideas of things that you think might especially benefit
from such acceleration please let me know :slight_smile:

Thanks,
Johanna