Overcoming Performance Collapse for 100Gbps Cyber Security

In this paper, we present a series of performance tests carried out on R-Scope Dominate-T (RDT), a 1U network security appliance configured with four Tilera Gx-36 processors and with an aggregated network IO capacity of 160Gbps. RDT is optimized with several high-performance computing techniques. On the software side, RDT runs Linux and a modified version of Bro–the open source network security monitor developed by the International Computer Science Institute–optimized with (1) intelligent IDS-aware packet queuing, (2) Bro-programmable packet shunting, (3) zero-locking IPC data structures, and (4) layer-4 packet prioritization. On the hardware side, the system leverages a many-core architecture with (1) 144 cores servicing 16 x 10Gbps network interfaces, (2) an on-chip ASIC-assisted engine delivering packets directly to Bro at wire rates, and (3) core-programmable zero-overhead/zero-interrupt Linux.