Nondestructive measurement device for multiple high-speed network interfaces

Abstract

The invention relates to the technical field of network flow monitoring, in particular to a multi-high-speed network interface nondestructive measurement device, which comprises measurement hardware and a processor, the measurement hardware is connected with a plurality of high-speed network interfaces and comprises a plurality of matching counting tables, each high-speed network interface is distributed with one matching counting table, each matching counting table comprises a multi-channel memory table, and the multi-channel memory table is connected with the processor. The matching counting table measures data packets flowing in from the high-speed network interface based on the matching counting path, the matching counting table sequentially updates the memory tables based on the updating path, and the non-updated memory tables simultaneously use the matching counting path to measure the data packets; and processing software is deployed on the processor, and the processing software processes the measurement intermediate result of the current measurement window uploaded by the measurement hardware based on the plurality of mirrored matching counting tables to obtain a measurement report of the current measurement window and a prediction flow of the next measurement window. Therefore, the problem that the flow measurement of a plurality of high-speed network interfaces cannot be realized in the prior art is solved.

Description

Technical Field

[0001] This application relates to the field of network traffic monitoring technology, and in particular to a non-destructive measurement device for multiple high-speed network interfaces. Background Technology

[0002] In today's digital age, network traffic is experiencing explosive growth, making efficient and accurate network traffic measurement crucial for network management, optimization, and quality of service assurance. Especially in high-speed network environments, such as 100GE network interfaces, achieving precise flow statistics is a significant challenge.

[0003] Currently, measurements of a single 100GE network interface primarily utilize either a pure software approach or an FPGA (Field-Programmable Gate Array)-assisted approach. In the pure software approach, the DPDK (Data Plane Development Kit) method improves efficiency through multi-core parallel processing; however, even with a 14-core CPU (such as an Intel i9-10940X), it can only handle 26.56Gbps of traffic, insufficient for a single 100GE port. When using an FPGA to handle only packet parsing offloading, the parsed results are processed in parallel by the CPU, significantly increasing measurement throughput; however, the large number of packets still requires a significant load. Experiments show that limited by the PCIe (Peripheral Component Interconnect Express) 3.0 bandwidth (32.16Gbps) and CPU processing power, the maximum supported throughput is only 96Gbps (approximately 1.3 × 100GE), still insufficient to fully utilize the capabilities of a 100GE port.

[0004] The key bottleneck of the above solution lies in the inability of the measurement hardware to produce highly aggregated intermediate results. FASTeller recognized this and used a complex hardware LRU to generate highly aggregated measurement intermediate results, which significantly reduced costs for a single 100GE network interface. However, its hardware architecture was too complex, resource-intensive, and could not be scaled to multiple high-speed interfaces (such as four 100GE network interfaces). Summary of the Invention

[0005] This application provides a non-destructive measurement device for multiple high-speed network interfaces to solve the problem that related technologies cannot achieve traffic measurement for multiple high-speed network interfaces.

[0006] The first aspect of this application provides a non-destructive measurement device for multiple high-speed network interfaces, comprising: measurement hardware and a processor, wherein the measurement hardware is connected to multiple high-speed network interfaces; the measurement hardware includes multiple matching counter tables, wherein each high-speed network interface is assigned a matching counter table, the matching counter table includes multiple memory tables, each memory table is configured with a matching counting path and an update path, the matching counter table measures data packets flowing into the high-speed network interface based on the matching counting path to count active flows in each measurement window and identify newly appearing flows in each measurement window, the matching counter table updates the memory tables sequentially based on the update path, and the memory tables that have not been updated simultaneously measure data packets using the matching counting path; the processor is equipped with processing software, wherein the processing software mirrors the multiple matching counter tables, and based on the mirrored multiple matching counter tables, processes the intermediate measurement results of the current measurement window uploaded by the measurement hardware to obtain a measurement report of the current measurement window and a predicted flow for the next measurement window, the predicted flow being used to update the memory tables.

[0007] Optionally, the measurement hardware also includes a control module, which updates each match count table and each static random access memory table in the match count table sequentially based on the prediction stream.

[0008] Optionally, the match counting table also includes an arbitrator, wherein the match counting path includes the path between each memory table and the arbitrator, and the path between each memory table and the queue, the update path includes the path between each memory table and the control module, and the queue buffers packets flowing in from the high-speed network interface.

[0009] Optionally, each memory table is configured with a first control signal and a second control signal, wherein the arbitrator controls the arbitration result of each memory table through the first control signal, and the control module controls the updating of the memory table, as well as the selection of the matching counting path and the update path, through the second control signal.

[0010] Optionally, the matching counter table further includes a first selector, a second selector, and a third selector. The input of the first selector is connected to the queue and the control module, respectively, and the output of the first selector is connected to the read port of the matching counter table. The input of the second selector is connected to the control module and the output of the third selector, respectively, and the output of the second selector is connected to the write port of the matching counter table. The input of the third selector is connected to the queue and the read port of the matching counter table, and the read port of the matching counter table is also connected to an arbitrator and the control module.

[0011] Optionally, the second control signal includes a first control value, a second control value, and a third control value. The control flow of the control module includes: if the current match count table is not updated, then for the memory table in the current match count table, the second control signal of the current memory table is set to the first control value, controlling the first selector and the second selector to open the match count path. When a data packet hits the current memory table, the third selector writes the updated entry of the current memory table into the current memory table. When a data packet does not hit the current memory table, the third selector determines the overflow entry according to the arbitration result of the arbitrator. If the current match count table is updated, then for the memory table in the current match count table, when updating other memory tables, the second control signal of the current memory table is set to the second control value. When a data packet hits the current memory table, the third selector updates the counter in the current memory table. When a data packet does not hit the current memory table, the third selector updates the negative vote field in the current memory table without overflowing any entries. If the current match count table is updated, then for the memory table in the current match count table, when updating the current memory table, the second control signal of the current memory table is set to the third control value, and each entry of the current memory table is replaced sequentially based on the prediction flow.

[0012] Optionally, the memory table includes multiple entries, each containing a stream identifier, a stream packet count, a negative vote field, and a stream byte count. When a stream in the data stream hits the current memory table, the stream packet count and stream byte count of the current memory table are updated, and the negative vote fields of other memory tables in the current match count table are added. When a stream in the data stream does not hit the current memory table, the conflicting entries are transmitted to the arbitrator for voting, and the overflow entry is determined based on the voting result. The arbitrator is configured with a voting mechanism, which includes: checking whether the negative vote field of the conflicting entry meets the overflow condition; if the overflow condition is met, the conflicting entry is overflowed; if multiple conflicting entries meet the overflow condition, the conflicting entry with the largest ratio of negative votes to stream packet count is selected for overflow, wherein the overflow condition is that the negative vote field exceeds a preset multiple of the stream packet count.

[0013] Optionally, the measurement hardware also includes a mask module, an interconnect module, a hardware cache, and a controller for the hardware cache. The interconnect module communicates bidirectionally with the mask module, the controller, the control module, and the processor. The mask module merges overflow entries from multiple matching count tables into a single data block and bursts it into the hardware cache. The hardware cache is divided into a first region, a second region, and a third region. The first region stores the intermediate measurement results burst-written by the mask module, the second region stores the intermediate measurement results output by the matching count table, and the third region stores the prediction stream.

[0014] Optionally, the controller is equipped with a direct memory access module, and the processing flow of the processing software includes: at the end of each measurement window, a read request is initiated to the direct memory access module; the direct memory access module responds to the read request and uploads the intermediate measurement results to the processing software; the intermediate measurement results of the current measurement window are aggregated into a measurement report; the active flow in the next measurement window is predicted based on the intermediate measurement results of the current measurement window; and the predicted active flow in the next measurement window is used as the predicted flow.

[0015] Optionally, the processor is provided with a buffer and a task area. The buffer stores intermediate measurement results, and the task area is provided with multiple processing tasks. The processing tasks and the buffer are connected by a circular queue. The multiple processing tasks are executed in parallel, and the total time of the multiple processing tasks is less than the overflow threshold.

[0016] Therefore, this application has at least the following beneficial effects:

[0017] This application embodiment constructs a lossless device for multiple high-speed network interfaces, including measurement hardware and a processor, which can realize traffic measurement of multiple high-speed network interfaces. Specifically, the measurement hardware includes multiple matching counter tables, each of which includes multiple memory tables. The matching counter tables measure the data packets flowing into the high-speed network interfaces based on the matching counting path to count the active flow in each measurement window and identify the newly appearing flow in each measurement window. The matching counter tables update the memory tables sequentially based on the update path. The memory tables that have not been updated are simultaneously used to measure data packets using the matching counting path. Thus, during the update, only the memory tables that need to be updated are unavailable, while other memory tables that have not been updated can perform matching counting normally, achieving uninterrupted updates during measurement. The processor processes the intermediate measurement results of the current measurement window uploaded by the measurement hardware based on the mirrored multiple matching counter tables, obtaining the measurement report of the current measurement window and the predicted flow of the next measurement window. The predicted flow is used to update the memory tables. In short, the measurement hardware is used to implement matching counting in a simple way with low hardware complexity. The matching software item in the matching count is specified by the processor, which is highly flexible. Therefore, it solves the technical problems of related technologies that cannot realize traffic measurement of multiple high-speed network interfaces.

[0018] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0019] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0020] Figure 1A schematic diagram of a solution for measuring network interface flow in related technologies;

[0021] Figure 2 A schematic diagram of a scheme for measuring network interface flow in another related technology;

[0022] Figure 3 This is a schematic diagram of a non-destructive measurement device with multiple high-speed network interfaces provided according to an embodiment of this application;

[0023] Figure 4 This is an architecture diagram of a memory table provided according to an embodiment of this application;

[0024] Figure 5 This is a flowchart illustrating the operation of the voting mechanism provided according to the embodiments of this application;

[0025] Figure 6 This is an overall architecture diagram of the measuring device provided according to an embodiment of this application;

[0026] Figure 7 This is a measurement hardware architecture diagram provided according to an embodiment of this application;

[0027] Figure 8 This is an overall architecture diagram of the matching count table provided according to an embodiment of this application;

[0028] Figure 9 This is an overall architecture diagram of the software portion provided according to an embodiment of this application. Detailed Implementation

[0029] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0030] Before describing the solution of this application, let me first introduce the relevant technologies of this application to help you understand the solution of this application.

[0031] Current AFC (Accurate Flow Counting) solutions suffer from the following bottlenecks when measuring a single 100GE network interface:

[0032] Pure software solutions, such as Figure 1 As shown, even with pure software multi-core parallel processing, the DPDK-based method can only handle 26.56Gbps of traffic with a 14-core CPU (Intel i9-10940X), which cannot meet the requirements of a single 100GE port.

[0033] When the FPGA only implements message parsing offloading, the parsed results are processed in parallel by the CPU, such as... Figure 2 As shown, this can significantly increase measurement throughput; however, due to the large number of packets, a significant load is still required. Limited by PCIe 3.0 bandwidth (32.16Gbps) and CPU processing power, it only supports a maximum of 96Gbps (approximately 1.3×100GE).

[0034] To this end, this application provides a non-destructive measurement device for multiple high-speed network interfaces. In this device, a hardware-software co-design method is used to implement a low-cost, multi-port (e.g., 4×100Gbps) accurate flow statistics system on a single host.

[0035] Specifically, Figure 3 This is a schematic diagram of a non-destructive measurement device with multiple high-speed network interfaces provided in an embodiment of this application.

[0036] like Figure 3 As shown, the multi-high-speed network interface non-destructive measurement device 10 includes: measurement hardware 11 and processor 12.

[0037] The measurement hardware 11 is connected to multiple high-speed network interfaces and includes multiple matching counter tables. Each high-speed network interface is assigned one matching counter table, which includes multiple memory tables. Each memory table is configured with a matching counting path and an update path. The matching counter tables measure the data packets flowing into the high-speed network interfaces based on the matching counting paths to count the active flows in each measurement window and identify newly appearing flows in each measurement window. The matching counter tables update the memory tables sequentially based on the update paths. Unupdated memory tables simultaneously measure data packets using the matching counting paths. Processing software is deployed on the processor 12. The processing software mirrors the multiple matching counter tables and processes the intermediate measurement results of the current measurement window uploaded by the measurement hardware based on the mirrored multiple matching counter tables to obtain the measurement report of the current measurement window and the predicted flow of the next measurement window. The predicted flow is used to update the memory tables.

[0038] It is understood that this application embodiment constructs a lossless device 10 for multiple high-speed network interfaces, including measurement hardware 11 and processor 12, which can realize traffic measurement of multiple high-speed network interfaces. Specifically, the measurement hardware 11 includes multiple matching count tables, each of which includes multiple memory tables. The matching count tables measure the data packets flowing into the high-speed network interface based on the matching count path to count the active flow in each measurement window and identify the newly appearing flow in each measurement window. The matching count tables update the memory tables sequentially based on the update path. The memory tables that have not been updated simultaneously use the matching count path to measure the data packets, so that during the update, only the memory tables that need to be updated cannot be used, while other memory tables that have not been updated can normally realize matching count, realizing uninterrupted updates during measurement. The processor 12 processes the intermediate measurement results of the current measurement window uploaded by the measurement hardware based on the mirrored multiple matching count tables, and obtains the measurement report of the current measurement window and the predicted flow of the next measurement window. The predicted flow is used for updating the memory tables. In short, the measurement hardware 11 is used to implement matching count, which is simple and has low hardware complexity. The matching software item in the matching count is specified by the processor, which is highly flexible.

[0039] The memory table in this application embodiment can be an M-way K-entry SRAM (Static Random-Access Memory), and each match count table is implemented by a dual-port SRAM with M-way K-entries.

[0040] In this embodiment, the measurement hardware 11 further includes a control module, wherein the control module updates each matching count table and each static random access memory table in the matching count table sequentially based on the prediction stream.

[0041] It is understood that the measurement hardware 11 in this application embodiment also includes a control module, which updates each matching count table and each static random access memory table in the matching count table in turn based on the prediction flow.

[0042] In this embodiment of the application, the matching counter table further includes an arbitrator, wherein the matching counting path includes the path between each memory table and the arbitrator, and the path between each memory table and the queue, the update path includes the path between each memory table and the control module, and the queue caches data packets flowing in from the high-speed network interface.

[0043] It is understood that the matching counter table in this application embodiment also includes an arbitrator, the matching counter path includes the path between each memory table and the arbitrator, and the path between each memory table and the queue, the update path includes the path between each memory table and the control module, and the queue caches data packets flowing in from the high-speed network interface.

[0044] In this embodiment of the application, each memory table is configured with a first control signal and a second control signal. The arbitrator controls the arbitration result of each memory table through the first control signal, and the control module controls the updating of the memory table and the selection of the matching counting path and the update path through the second control signal.

[0045] The first control signal can be lctl, and the second control signal can be gctl.

[0046] It is understood that each memory table in the embodiments of this application is configured with a first control signal and a second control signal, so as to determine the current operation through the control signal, such as update, match counting or arbitration.

[0047] In this embodiment of the application, the matching counter table further includes a first selector, a second selector, and a third selector. The input terminal of the first selector is connected to the queue and the control module, respectively, and the output terminal of the first selector is connected to the read port of the matching counter table. The input terminal of the second selector is connected to the control module and the output terminal of the third selector, respectively, and the output terminal of the second selector is connected to the write port of the matching counter table. The input terminal of the third selector is connected to the queue and the read port of the matching counter table, and the read port of the matching counter table is also connected to an arbitrator and the control module.

[0048] The first selector can be A, the second selector can be B, and the third selector can be C.

[0049] It is understood that the matching counter table in this application embodiment further includes first to third selectors. The input of the first selector A is connected to the queue and the control module, respectively. The output of the first selector is connected to the read port rd of the matching counter table. The input of the second selector is connected to the control module and the output of the third selector, respectively. The output of the second selector is connected to the write port wr of the matching counter table. The input of the third selector is connected to the queue and the read port rd of the matching counter table, respectively. The read port rd of the matching counter table is also connected to an arbitrator and the control module. The specific SRAM table architecture is as follows: Figure 3 As shown.

[0050] In this embodiment, the second control signal includes a first control value, a second control value, and a third control value. The control flow of the control module includes: if the current match count table is not updated, then for the memory table in the current match count table, the second control signal of the current memory table is set to the first control value, and the first selector and the second selector are controlled to open the match count path. When a data packet hits the current memory table, the third selector writes the updated entry of the current memory table into the current memory table. When a data packet does not hit the current memory table, the third selector determines the overflow entry according to the arbitration result of the arbitrator. If the current match count table is updated, then for the memory table in the current match count table, when updating other memory tables, the second control signal of the current memory table is set to the second control value. When a data packet hits the current memory table, the third selector updates the counter in the current memory table. When a data packet does not hit the current memory table, the third selector updates the negative vote field in the current memory table without overflowing any entries. If the current match count table is updated, then for the memory table in the current match count table, when updating the current memory table, the second control signal of the current memory table is set to the third control value, and each entry of the current memory table is replaced sequentially based on the prediction flow.

[0051] The second control signal includes a first control signal (gctl is 0), a second control signal (gctl is 1), and a third control signal (gctl is 2).

[0052] Specifically, combined Figure 4 The control flow controlled by the control module in this embodiment includes:

[0053] In the match-count path, data read from the rd port of SRAM is output to the arbiter module of the match-count table. Data written to the wr port comes from two sources: a new stream flowing in from the interface and an updated entry in the SRAM. The data selector C selects one of these sources based on the arbiter's lctl and writes it into the SRAM.

[0054] When the match-count table needs to be updated, data selectors A and B open the control module update path via gctl. At this time, the data read from SRAM is output to the control module and ultimately burst-written into the D1 region of the hardware cache. The prediction stream to be installed is written into SRAM via the wr port.

[0055] When the control module does not update the SRAM table, gctl is 0, and data selectors A and B open the match-count path. When a data packet hits the SRAM table, selector C writes the updated SRAM table entry into the SRAM; otherwise, selector C needs to determine the overflow entry based on the lctl output by the arbitrator.

[0056] When the control module updates other SRAM tables in the match-count table, the gctl of the current SRAM table is set to 1. At this time, selector C only updates the counter in the table when the packet hits the SRAM table, and only updates the negative vote field in the table without overflowing any table entries when the packet misses the match.

[0057] When the control module updates the current SRAM table, its gctl is set to 2. At this time, the control module replaces each entry of the SRAM table in sequence.

[0058] In this embodiment, the memory table includes multiple entries, each including a flow identifier, a flow packet count, a negative vote field, and a flow byte count. When a flow in the data stream hits the current memory table, the flow packet count and flow byte count of the current memory table are updated, and the negative vote fields of other memory tables in the current match count table are added. When a flow in the data stream does not hit the current memory table, the conflicting entries are transmitted to the arbitrator for voting, and an overflow entry is determined based on the voting result. The arbitrator is configured with a voting mechanism, which includes: checking whether the negative vote field of the conflicting entry meets the overflow condition; if the overflow condition is met, the conflicting entry is overflowed; if multiple conflicting entries meet the overflow condition, the conflicting entry with the largest ratio of negative votes to flow packet count is selected for overflow, wherein the overflow condition is that the negative vote field exceeds a preset multiple of the flow packet count.

[0059] The preset multiplier can be set according to specific circumstances, and there are no specific limitations on it.

[0060] Since relying solely on the match-count table to measure active flows is insufficient to generate highly aggregated intermediate measurement results, the processing software cannot predict active flows that have not yet appeared from the measurement history. Furthermore, predicted active flows will gradually become inactive over time; if they are not promptly overflowed, they will occupy the match-count table for an extended period, reducing its hit rate. Therefore, the voting mechanism in this application enables the match-count table to self-update during the match-counting process, thereby promptly identifying newly added active flows and overflowing inactive flows during measurement, significantly improving the hit rate of the match-count table and generating highly aggregated intermediate measurement results.

[0061] Specifically, the voting mechanism of this application operates as follows: Figure 5 As shown, it includes:

[0062] Each entry in the SRAM table consists of a stream ID (stream flag), a stream packet count counter, a negative vote field, and a stream byte count counter. When the control module installs the predicted stream, it initializes all fields in the SRAM table except the stream ID to 0, such as... Figure 5 The stream f0 in the SRAM table. After installation, the SRAM table begins to run a match-counting and voting mechanism. When a stream hits the SRAM table, such as... Figure 5If stream f1 is found in the match-count table, then the number of stream packets and the number of stream bytes for that entry are updated. Simultaneously, other SRAM tables in the match-count table will inevitably experience hash collisions. These SRAM tables need to increment their negative vote fields by 1 to speed up the overflow of inactive streams. If no match is found, such as... Figure 5 If streams f4 and f2 collide, and f5 and f3 collide, both f2 and f3 will be sent to the arbitrator for voting to determine the overflow entry. The voting mechanism checks if the negative vote field exceeds λ times the number of stream packets. If the condition is met, the arbitrator considers the entry in the table to be no longer active and should overflow.

[0063] For example, suppose Figure 5 In the middle voting parameter λ=1, the negative vote field of f2 increases by 1 after a hash collision, but it is still not λ times the number of stream packets. Therefore, f2 is retained in the table while f4 overflows. After a hash collision, the negative vote of f3 increases by 1 and becomes λ times the number of stream packets. Therefore, the arbitrator sets lctl, causing f3 to overflow, and f5 is replaced into the SRAM table.

[0064] Because the match-count table contains multiple SRAM tables, the arbiter needs to read the conflict entries of all SRAM tables before making a unified decision. When multiple conflicting entries meet the overflow conditions of the voting mechanism, the arbiter will select the entry with the largest ratio of negative votes to the number of stream packets to overflow. After determining the SRAM table whose entries need to be replaced, the arbiter sets its lctl bit, and sets the lctl bit of the remaining SRAM tables to 0.

[0065] In this embodiment, the measurement hardware further includes a masking module, an interconnect module, a hardware cache, and a controller for the hardware cache. The interconnect module communicates bidirectionally with the masking module, the controller, the control module, and the processor. The masking module merges overflow entries from multiple matching count tables into a single data block and bursts it into the hardware cache. The hardware cache is divided into a first region, a second region, and a third region. The first region stores the intermediate measurement results burst-written by the masking module, the second region stores the intermediate measurement results output by the matching count table, and the third region stores the prediction stream.

[0066] The first region, D0, is used to store intermediate measurement results burst-written by the mask module; the second region, D1, is used to store intermediate measurement results output by the match count table; and the third region, R, is used to store the prediction stream.

[0067] It is understood that the measurement hardware in this application embodiment also includes a mask module, an interconnect module, a hardware cache, and a controller for the hardware cache. The interconnect module communicates bidirectionally with the mask module, the controller, the control module, and the processor.

[0068] In this embodiment of the application, the controller is provided with a direct memory access module, and the processing flow of the processing software includes: initiating a read request to the direct memory access module at the end of each measurement window; the direct memory access module responds to the read request and uploads the intermediate measurement results to the processing software; aggregating the intermediate measurement results of the current measurement window into a measurement report; predicting the active flow in the next measurement window based on the intermediate measurement results of the current measurement window; and using the predicted active flow in the next measurement window as the predicted flow.

[0069] Among them, the direct memory access module can be a DMA (Direct Memory Access) module.

[0070] It is understood that the controller in this application embodiment is provided with a direct memory access module. During each measurement window, the processing software initiates a read request to the direct memory access module. The direct memory access module responds to the read request and uploads the intermediate measurement results to the processing software. It aggregates the intermediate measurement results of the current measurement window into a measurement report, predicts the active flow in the next measurement window based on the intermediate measurement results of the current measurement window, and uses the predicted active flow in the next measurement window as the predicted flow.

[0071] In this embodiment, the processor is provided with a buffer and a task area. The buffer stores intermediate measurement results, and the task area is provided with multiple processing tasks. The processing tasks and the buffer are connected by a circular queue. The multiple processing tasks are executed in parallel, and the total time of the multiple processing tasks is less than the overflow threshold.

[0072] It is understood that the processor in this embodiment of the application is provided with a buffer and a task area. The buffer stores intermediate measurement results, and the task area is provided with multiple processing tasks. The processing tasks and the buffer are connected through a circular queue. The multiple processing tasks are executed in parallel, and the total time of the multiple processing tasks is less than the overflow threshold to ensure that the buffer does not overflow.

[0073] Specifically, the multi-high-speed network interface non-destructive measurement device of this application embodiment can be named the AcMon measurement device, and its overall architecture is as follows: Figure 6 As shown, Figure 6 As shown, the overall process of non-destructive testing includes:

[0074] 1. Match-Counting: AcMon allocates a match-counting table for each network interface, consisting of M channels and K entries in SRAM. When a data packet enters the measurement hardware through the network interface and is parsed, its flow ID is mapped to addresses in all SRAMs by M hash functions and matched against entries in these tables. If a match is found (at most one SRAM table is matched), its corresponding counter is updated; otherwise, AcMon uses a voting mechanism to overflow one entry in the match-counting table, forming a measurement intermediate result (IR) and proceeding to step 2. The overflow entry from the match-counting table is embedded with the ID number of the network interface it entered.

[0075] 2. Burst Write to Hardware Cache: Entries overflowing from the match-count table will be burst-written to the hardware cache to fully utilize write bandwidth. AcMon uses a mask module to indicate whether the match-count table output is valid. If the match-count table for interface i has no overflow entries, the mask module sets the i-th valid bit to 0 to indicate that its data is invalid. Intermediate measurement results in the hardware cache will be uploaded to the software in the next step.

[0076] 3. Upload to Software: At the end of each measurement window, AcMon's software will initiate a DMA read request to notify the DMA module of the measurement hardware to read the intermediate measurement results cached in the hardware to the software. AcMon can flexibly set different measurement time windows simply by adjusting the timing of the DMA read request.

[0077] 4. Software aggregation: While aggregating the intermediate measurement results into the final measurement report, AcMon's software predicts the active streams in the next measurement window based on the results of the current measurement window and installs them in the match-count table. Specifically, the software sorts the final measurement report in descending order of the number of packets and determines the top K streams (Top-K) in the current measurement window. These streams will be regarded as active streams in the next window and installed into the match-count table of the measurement hardware. The match-count table consists of M-way K-entries SRAM, which naturally forms an M-way cuckoo hash table. Therefore, the software uses a multi-way cuckoo hash algorithm

[150] to maintain the mirrored match-count table and inserts the predicted active streams into it. After resolving the hash collisions in the mirrored match-count table, the software writes it to the hardware via DMA to complete the installation of the active streams.

[0078] Using this method, the measurement hardware can measure the flow without implementing a hardware cuckoo hash table, but instead uses a de facto cuckoo hash table, significantly improving the hit rate of the match-count table.

[0079] In addition, it should be noted that steps 1-3 above are implemented by hardware (i.e., measurement hardware), and step 4 is implemented by software (i.e., processor).

[0080] Figure 7 AcMon's measurement hardware architecture is as follows: AcMon allocates a match-count table for each network interface. Data packets flowing into the interface undergo line-rate packet parsing, stream ID and stream byte count extraction, and interface ID embedding before being queued for match-counting. The mask module merges the outputs of all interfaces' match-count tables into a single data block burst and writes it to the hardware cache (implemented by DRAM (Dynamic Random-Access Memory)). The interconnect module connects the mask module, control module, hardware cache controller, and PCIe module, enabling communication between any two modules. The hardware cache is divided into three regions: D0, D1, and R. Region D0 stores intermediate measurement results burst-written by the mask module. Region D1 stores intermediate measurement results from the match-count tables. After the software completes the maintenance of the mirrored match-count tables, the DMA module first writes them to region R, and then the control module installs them into the match-count table of each interface. The DMA module is responsible for... Figure 7 The PCIe-based DMA module.

[0081] The core of the AcMon measurement hardware is a match-count table consisting of an M-way K-entry SRAM table. It not only uses a match-counting mechanism to count active flows in the measurement window, but also employs a voting mechanism for self-updating to identify newly appearing flows in the measurement window. When a predicted flow is installed on the match-count table, its measurement of active flows is not interrupted.

[0082] The design of the match-count table will be described below, detailing its measurement principles and how to update the prediction stream without interrupting the measurement of b.

[0083] Figure 8 For the sake of clarity, regarding the overall architecture of the matching-counting table, Figure 8 The data path for updates by the control module is omitted. Each match-count table is implemented by a dual-port SRAM with M K entries. Within each match-count table, each SRAM table has two control signals: an LCTL for the arbitrator module to implement the voting mechanism, and a GCTL for the control module to update the prediction stream.

[0084] Each data packet stored in the queue uses M different hash functions to map its stream ID to the addresses of M SRAM tables and matches it against the entries in those tables. The hash functions are implemented based on CRC32 cyclic redundancy check codes with different initial values ​​and polynomials. Whether it's the initial stream installed with the match-count table or a software-generated mirrored match-count table, it must be guaranteed that each stream ID appears in at most one of the M SRAM tables. Therefore, a data packet either hits only one SRAM table or misses all of them. All SRAM table matching results are transmitted to the arbiter. If a data packet hits an SRAM table, the corresponding counter is updated, and the lctl of all SRAM tables is 0 because there are no overflow entries; the arbiter outputs invalid data. If there are no overflow entries, the arbiter will decide the overflow entry through a voting mechanism. When a conflicting entry in the i-th SRAM table needs to overflow, the arbiter sets lctl[i] to overflow the old entry and adds the conflicting stream. If the number of stream packets in the overflow entry is 0, it indicates that the software's predicted stream is not appearing in the current measurement window, and the arbitrator outputs invalid data; otherwise, the arbitrator outputs the overflow entry to the mask module.

[0085] The control module uses the three-valued signal `gctl` to control the SRAM tables. When the software does not need to update the match-count table, `gctl` is 0. During updates, the control module needs to traverse each SRAM table, read the old entries, and add new prediction streams; therefore, only one SRAM table is being updated at a time. Assuming the i-th SRAM table is being updated, then `gctl[i] = 2, gctl[j] = 1, (j ≠ i). Each SRAM table implements two data paths: match-count and control module update. Through the control of the `gctl` signal, even during match-count table updates, SRAM tables that are not being updated can still use the match-count path to measure data packets, thus achieving uninterrupted updates.

[0086] Figure 4 To construct the SRAM table architecture in the match-count table, it consists of a dual-port SRAM and three data selectors (MUX) A, B, and C, implementing two data paths: match-count and control module update. In the match-count path, data read from the rd port of the SRAM is output to the arbiter module of the match-count table. Data written to the wr port comes from two sources: new streams flowing in from the interface and updated entries in the SRAM. Data selector C selects one of these sources based on the arbiter's lcctl and writes it to the SRAM. When the match-count table needs to be updated, data selectors A and B open the control module update path via gctl. At this time, data read from the SRAM is output to the control module and ultimately burst-written to the D1 area of ​​the hardware cache. The predicted stream to be installed is written to the SRAM through the wr port.

[0087] When the control module does not update the SRAM table, gctl is 0, and data selectors A and B open the match-count path. When a data packet hits the SRAM table, selector C writes the updated SRAM table entry into the SRAM; otherwise, selector C needs to determine the overflow entry based on the lctl output by the arbitrator. When lctl = 0, selector C updates the negative vote field in the SRAM used for the voting mechanism; when lctl = 1, selector C replaces the new flow from the interface into the SRAM.

[0088] When the control module updates other SRAM tables in the match-count table, the gctl of the current SRAM table is set to 1. In this case, selector C only updates the counter in the SRAM table when a packet hits it; otherwise, it only updates the negative vote field without overflowing any entries. When the control module updates the current SRAM table, its gctl is set to 2. The control module then sequentially replaces each entry in the SRAM table, and the read data is ultimately burst-written into the D1 area of ​​the hardware buffer by the control module. At this time, packets from the interface are treated as misses and directly output to the arbitrator module, and are finally written into the D0 area of ​​the hardware buffer by the mask module, achieving uninterrupted updates.

[0089] It's important to note that relying solely on the match-count table to measure active flows is insufficient to generate highly aggregated intermediate measurement results, as the software cannot predict active flows that haven't appeared in the measurement history. Furthermore, predicted active flows will gradually become less active over time; if they aren't promptly overflowed, they will occupy the match-count table for an extended period, reducing its hit rate. AcMon employs a voting mechanism that enables the match-count table to self-update during the match-counting process. This allows for timely identification of newly added active flows and overflow of inactive flows during measurement, significantly improving the hit rate of the match-count table and generating highly aggregated intermediate measurement results.

[0090] Figure 5 This describes the operation of the AcMon voting mechanism. Each entry in the SRAM table consists of a stream ID, a stream packet count counter, a negative vote field, and a stream byte count counter. When the control module installs the predicted stream, it initializes all fields in the SRAM table except the stream ID to 0, such as... Figure 5 The stream f0 in the SRAM table. After installation, the SRAM table begins to run a match-counting and voting mechanism. When a stream hits the SRAM table, such as... Figure 5 If stream f1 is found in the match-count table, then the number of stream packets and the number of stream bytes for that entry are updated. Simultaneously, other SRAM tables in the match-count table will inevitably experience hash collisions. These SRAM tables need to increment their negative vote fields by 1 to speed up the overflow of inactive streams. If no match is found, such as... Figure 5If streams f4 and f2 collide, and f5 and f3 collide, both f2 and f3 will be sent to the arbitrator for voting to determine the overflow entry. The voting mechanism checks if the negative vote field exceeds λ times the number of stream packets. If the condition is met, the arbitrator considers the entry in the table to be no longer active and should overflow.

[0091] For example, suppose Figure 5 In the middle voting parameter λ=1, the negative vote field of f2 increases by 1 after a hash collision, but it is still not λ times the number of stream packets. Therefore, f2 is retained in the table while f4 overflows. After a hash collision, the negative vote of f3 increases by 1 and becomes λ times the number of stream packets. Therefore, the arbitrator sets lctl, causing f3 to overflow, and f5 is replaced into the SRAM table.

[0092] Because the match-count table contains multiple SRAM tables, the arbiter needs to read the conflict entries of all SRAM tables before making a unified decision. When multiple conflicting entries meet the overflow conditions of the voting mechanism, the arbiter will select the entry with the largest ratio of negative votes to the number of stream packets to overflow. After determining the SRAM table whose entries need to be replaced, the arbiter sets its lctl bit, and sets the lctl bit of the remaining SRAM tables to 0.

[0093] Figure 9 This describes the overall architecture of the AcMon software. AcMon uses a single CPU core to handle all DMA tasks, including reading intermediate measurement results from the hardware into the MBUF buffer and writing the mirror match-count table to the R region of the hardware cache. Since the DMA tasks mainly involve configuring relevant hardware registers, a single CPU core is sufficient for efficient completion. The MBUF buffer can hold all intermediate measurement results within the worst-case scenario of the measurement window. For example, when measuring four 100GE interfaces with a measurement time window of 10 milliseconds, a buffer size of 500 Mbit is sufficient. AcMon allocates a processing task for each measurement interface, executed in parallel with high throughput by several CPU cores, thus meeting the requirements. Figure 9 The time constraints are shown.

[0094] Processing tasks and buffers are connected via circular queues. The receiving core dispatches pointers to these data into the corresponding circular queues based on the interface ID number embedded in the measurement intermediate results. The corresponding processing task retrieves the measurement intermediate results through the pointers in the queue, and then completes the tasks of generating the final measurement report, predicting the active flow, and updating the match-count table. After obtaining the measurement intermediate results, each interface's processing task will use all CPU cores allocated to that task to aggregate the measurement intermediate results and generate the final measurement report.

[0095] Upon completion, the processing task sorts the final measurement reports in that window in descending order by the number of flow packets to obtain the top K flows. Figure 9The task is abbreviated as Top-K in Chinese, and these prediction streams will be written into the match-count table as the active streams of the next measurement window.

[0096] Finally, Figure 9 In the MCT update task shown, the software uses the M-way Cuckoo Hash Algorithm

[150] to insert the prediction stream into its maintained mirror match-count table. The hash function used in this process is exactly the same as that used in the measurement hardware. After completion, the mirror match-count table generated by the processing task is written to the R region of the hardware cache by the receive core DMA. To ensure that the buffer does not overflow, the total processing time Tprocess needs to meet the following requirements. Figure 9 The time constraint in the process is Tprocess≤T-t2.

[0097] In summary, the non-destructive measurement device for multiple high-speed network interfaces proposed in this application can measure multiple high-speed interfaces, and the hardware implementation of matching counting is simple and meets the requirement of low hardware complexity. Furthermore, the matching items in the matching count are specified by software, offering high flexibility; therefore, a high number of matching entries can be achieved by flexibly modifying the software.

[0098] The non-destructive measurement device for multiple high-speed network interfaces proposed in this application includes measurement hardware and a processor. It can measure the traffic of multiple high-speed network interfaces. Specifically, the measurement hardware includes multiple matching count tables, each of which includes a multi-path memory table. The matching count tables measure the data packets flowing into the high-speed network interface based on the matching count path to count the active flow in each measurement window and identify the newly appearing flow in each measurement window. The matching count tables update the memory tables sequentially based on the update path. The memory tables that have not been updated are simultaneously used to measure data packets using the matching count path. This ensures that during the update, only the memory tables that need to be updated are unavailable, while other memory tables that have not been updated can perform matching counts normally, enabling uninterrupted updates during measurement. The processor processes the intermediate measurement results of the current measurement window uploaded by the measurement hardware based on the mirrored multiple matching count tables, obtaining the measurement report of the current measurement window and the predicted flow of the next measurement window. The predicted flow is used to update the memory tables. In short, the measurement hardware is used to implement matching counts in a simple way with low hardware complexity. The matching software item in the matching count is specified by the processor, which provides high flexibility.

[0099] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0100] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0101] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0102] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or more of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (FPGAs), field-programmable gate arrays (FPGAs), etc.

[0103] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it includes one or a combination of the steps of the method embodiments.

Claims

1. A non-destructive measurement device with multiple high-speed network interfaces, characterized in that, include: Measurement hardware and processor, wherein the measurement hardware is connected to multiple high-speed network interfaces; The measurement hardware includes multiple match counting tables, with one match counting table assigned to each high-speed network interface. Each match counting table includes multiple memory tables, each configured with a match counting path and an update path. The match counting table measures data packets flowing into the high-speed network interface based on the match counting path to count active flows in each measurement window and identify newly appearing flows in each measurement window. The match counting table updates the memory tables sequentially based on the update path, and memory tables that have not been updated simultaneously measure data packets using the match counting path. The processor is equipped with processing software, which mirrors the plurality of matching count tables. Based on the mirrored plurality of matching count tables, the processing software processes the intermediate measurement results of the current measurement window uploaded by the measurement hardware to obtain the measurement report of the current measurement window and the prediction stream of the next measurement window. The prediction stream is used to update the memory table.

2. The non-destructive measurement device with multiple high-speed network interfaces according to claim 1, characterized in that, The measurement hardware also includes a control module, wherein the control module updates each matching count table and each static random access memory table in the matching count table sequentially based on the prediction stream.

3. The non-destructive measurement device with multiple high-speed network interfaces according to claim 2, characterized in that, The matching counter table also includes an arbitrator, wherein the matching counting path includes the path between each memory table and the arbitrator, and the path between each memory table and the queue, the update path includes the path between each memory table and the control module, and the queue caches data packets flowing in from the high-speed network interface.

4. The non-destructive measurement device with multiple high-speed network interfaces according to claim 3, characterized in that, Each memory table is configured with a first control signal and a second control signal. The arbitrator controls the arbitration result of each memory table through the first control signal, and the control module controls the updating of the memory table, as well as the selection of the match counting path and the update path, through the second control signal.

5. The non-destructive measurement device with multiple high-speed network interfaces according to claim 4, characterized in that, The matching counter table further includes a first selector, a second selector, and a third selector. The input of the first selector is connected to the queue and the control module, respectively, and the output of the first selector is connected to the read port of the matching counter table. The input of the second selector is connected to the control module and the output of the third selector, respectively, and the output of the second selector is connected to the write port of the matching counter table. The input of the third selector is connected to the queue and the read port of the matching counter table, respectively. The read port of the matching counter table is also connected to the arbitrator and the control module.

6. The non-destructive measurement device with multiple high-speed network interfaces according to claim 5, characterized in that, The second control signal includes a first control value, a second control value, and a third control value. The control flow of the control module includes: If the current match count table is not updated, then for the memory table in the current match count table, the second control signal of the current memory table is set to the first control value, controlling the first selector and the second selector to open the match count path. When the data packet hits the current memory table, the third selector writes the updated entry of the current memory table into the current memory table. When the data packet does not hit the current memory table, the third selector determines the overflow entry according to the arbitration result of the arbitrator. If the current match count table is updated, then for the memory table in the current match count table, when updating other memory tables, the second control signal of the current memory table is set to the second control value. When the data packet hits the current memory table, the third selector updates the counter in the current memory table. When the data packet does not hit the current memory table, the third selector updates the negative vote field in the current memory table without overflowing any table entries. If the current match count table is updated, then for the memory table in the current match count table, when updating the current memory table, the second control signal of the current memory table is set to the third control value, and each entry of the current memory table is replaced sequentially based on the prediction flow.

7. The non-destructive measurement device with multiple high-speed network interfaces according to claim 3, characterized in that, The memory table includes multiple entries, each containing a stream identifier, a stream packet count, a negative vote field, and a stream byte count. When a stream in the data stream hits the current memory table, the stream packet count and stream byte count in the current memory table are updated, and the negative vote fields of other memory tables in the current match count table are added. When a stream in the data stream does not hit the current memory table, the conflicting entries are transmitted to the arbitrator for voting, and the overflow entries are determined based on the voting results. The arbitrator is configured with a voting mechanism, which includes: checking whether the negative vote field of the conflict entry meets the overflow condition; if the overflow condition is met, the conflict entry is overflowed; if multiple conflict entries meet the overflow condition, the conflict entry with the largest ratio of negative votes to the number of flow packets is selected for overflow, wherein the overflow condition is that the negative vote field exceeds a preset multiple of the number of flow packets.

8. The non-destructive measurement device with multiple high-speed network interfaces according to claim 7, characterized in that, The measurement hardware further includes a masking module, an interconnect module, a hardware cache, and a controller for the hardware cache. The interconnect module communicates bidirectionally with the masking module, the controller, the control module, and the processor. The masking module merges overflow entries from multiple matching count tables into a single data block and bursts it into the hardware cache. The hardware cache is divided into a first region, a second region, and a third region. The first region stores the intermediate measurement results burst-written by the masking module, the second region stores the intermediate measurement results output by the matching count tables, and the third region stores the prediction stream.

9. The non-destructive measurement device with multiple high-speed network interfaces according to claim 8, characterized in that, The controller is equipped with a direct memory access module, and the processing flow of the processing software includes: At the end of each measurement window, a read request is sent to the Direct Memory Access (DMI) module. The DMI module responds to the read request by uploading the intermediate measurement results to the processing software. The intermediate measurement results of the current measurement window are aggregated into a measurement report. The active flow in the next measurement window is predicted based on the intermediate measurement results of the current measurement window. The predicted active flow in the next measurement window is then used as the predicted flow.

10. The non-destructive measurement device with multiple high-speed network interfaces according to claim 9, characterized in that, The processor is provided with a buffer and a task area. The buffer stores the intermediate measurement results, and the task area is provided with multiple processing tasks. The processing tasks and the buffer are connected by a circular queue. The multiple processing tasks are executed in parallel, and the total time of the multiple processing tasks is less than an overflow threshold.

Images