Parallel Inline Tool Chaining for Network Latency Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge in computer networks is to reduce packet latency and increase network responsiveness when multiple inline security devices are chained together, as existing methods often result in increased additive latency, reduced TCP throughput, and increased packet memory requirements, leading to degraded network performance.
Innovation Solution
The implementation of an Advanced Inline Aggregation (AIA) device that processes ingress and egress packets by extracting header fields, generating hash indices, and using a hash table to manage packet forwarding, allowing simultaneous forwarding through multiple inline tools and managing latency timers to optimize packet transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple inline security devices are chained together to monitor and analyze network traffic, then network security is improved, but packet latency increases due to additive latency from each device
Solution Approach 1:
The system segments the packet processing workflow into two independent paths: a fast path for packets that have been processed by all inline tools (identified through hash table lookup and counter verification) and a slow path for packets requiring sequential processing. This segmentation allows security-critical packets to bypass the additive latency of sequential tool processing while maintaining security inspection for other packets.
Solution Approach 2:
The system performs preliminary actions by pre-computing hash indices from packet header fields and pre-storing packet identifiers in a hash table before the packets reach the inline tools. This preliminary preparation enables rapid identification and fast forwarding of packets that have completed processing, eliminating the need for sequential waiting and reducing overall latency.
2Reliability
If multiple inline security devices are chained together to examine information, then security detection capability is improved, but network throughput decreases due to processing bottlenecks
Solution Approach 1:
The system segments the packet flow into fast-forwarded packets and sequentially-processed packets based on completion status. By identifying packets that have been processed by all inline tools through hash table lookup and counter verification, the system can segment these packets into a fast path that bypasses further sequential processing, thereby increasing overall network throughput while maintaining security detection capability for other packets.
Solution Approach 2:
The hash table acts as an intermediary data structure that stores packet identifiers and their processing status. This intermediary enables the system to quickly determine which packets have completed processing by all inline tools without requiring each device to signal completion individually, thus reducing processing overhead and increasing throughput.
3Reliability
If multiple inline security devices are chained together to monitor traffic, then security coverage is improved, but packet memory requirements increase due to buffering needs
Solution Approach 1:
The system extracts only the essential packet identification information (header fields and packet identifier) into a compact hash table entry, rather than buffering entire packets in memory. This extraction approach significantly reduces memory requirements while maintaining the ability to track and fast-forward packets that have been processed by all inline security tools.
Solution Approach 2:
The system creates a compact copy of packet identification information (hash index and packet identifier) in the hash table, rather than storing or buffering the actual packet data. This copying strategy allows the system to track packet processing status with minimal memory overhead while still enabling fast forwarding of completed packets.
Data Source
AI summary
A method for parallel processing of ingress packets destined to a plurality of inline tools is provided. An ingress packet is processed to extract a plurality of packet header fields and to generate a packet identifier. A hash index is generated by hashing information associated with the plurality of packet header fields. A copy of the ingress packet and the packet identifier are stored in a hash table entry using the generated hash index. The ingress packet is simultaneously forwarded to each of the plurality of inline tool devices.