What happens to a firewall rule when a packet takes a shortcut around the software that normally enforces it? A network card developed by MIT Lincoln Laboratory engineer Jeffery Lim gives cloud researchers a way to investigate that question on hardware they can reprogram. The laboratory described the project on November 2, following a September conference presentation.
In a cloud server, several virtual machines can share a physical network card. A feature called single-root I/O virtualization gives each machine direct access to a portion of the device. That saves work on the host processor, but packets can then bypass the software switch that ordinarily directs traffic between virtual machines on the same server.
Lim and Boston University’s Martin Herbordt describe two jobs performed on their prototype. A table directs packets to their destination, including traffic that can stay on the server. A separate engine executes programmable rules for each tenant. Lim tested the design on two servers at home and used the Open Cloud Testbed for validation.
In a comparison with a commercial card configured for equivalent features, the authors found competitive throughput with up to 64 firewall rules. Beyond that range, delay in the programmable hardware became more apparent. In a separate all-to-all exchange involving 16 participants, the prototype outperformed the commercial card by 10 to 13 percent.
NAOAT analysis
The shape of those results matters to anyone building a test environment. A workload dominated by exchanges among nearby virtual machines may reward good switching performance. A workload that checks many rules before forwarding each packet exercises a different part of the same card. Reproducing both on a configurable device makes it possible to change one mechanism and measure what happens to the other.