CoFilter: High-Performance Switch-Accelerated Stateful Packet Filter for Bare-Metal Servers

As one of the most critical cloud services, Bare-Metal Servers (BMS) introduce stringent performance requirements on data center networks (DCN). Stateful packet filter is an integral DCN component of ensuring connection security for BMS. However, the off-the-shelf stateful packet filters either are costly for cloud DCNs or introduce significant performance bottlenecks. In this article, we present
CoFilter
, which leverages low-cost programmable switches to accelerate the stateful packet filter for BMS.
CoFilter
uses (1)
stateful process partition
to enable complex stateful packet filtering logic on programmability-limited switching ASICs, (2)
state compression
to track tens of millions of connections with constrained hardware memory, and (3)
per-tenant packet rate limit and tenant-aware flow migration
to achieve efficient performance isolation among different tenants. Overall,
CoFilter
implements a high-performance stateful packet filter via the co-design of programmable switching ASIC and CPU. We evaluate
CoFilter
under various data center traffic traces with real-world flow distributions. The evaluation results show that
CoFilter
remarkably outperforms NetFilter, i.e., forwarding packets at line rate (13x throughput of NetFilter), keeping packet delay within 1us, and freeing a significant quantity of CPU cores, with rather small memory usage, i.e., accommodating over
$10^7$
connections with only 16MB SRAM.