[dpdk-dev] Flow Director vs. 5-tuple filters on a 10GbE Intel 82599 ES NIC

[dpdk-dev] Flow Director vs. 5-tuple filters on a 10GbE Intel 82599 ES NIC

[Georgios Katsikas]

Dear all,

I am performing rule installation/deletion benchmarks on a dual port 10 GbE
Intel 82599 ES NIC using DPDK 18.11.
The benchmark installs increasing number of rules (5 to 8000), measures the
rule installation rate and latency and then deletes the rules (measuring
again the rule deletion rate/latency).
The rule sets comprise of rules with exact matches (no masks involved) as
follows:

*Simple rule*
flow create 0 ingress pattern eth / ipv4 dst is 129.72.224.94 / end actions
queue index 0 / end

*More complicated rule*
flow create 0 ingress pattern eth / ipv4 dst is 46.54.254.68 src is
49.75.141.195 proto is 17 / udp dst is 26561 src is 7242 / end actions
queue index 0 / end

No matter how simple or complicated the rules are, I am not able to install
more than 128 rules on this NIC.

*Here comes my question*

According to the specification
<https://www.intel.com/content/www/us/en/embedded/products/networking/82599-10-gbe-controller-datasheet.html>,
this NIC can accommodate up to 128 5-tuple filters, which very well agrees
with my observation above.
However, the same document states that this NIC can also accommodate up to
8000 Flow Director filters.
What is the practical difference between a 5-tuple and a Flow Director rule
in this case? How can I exploit these 8k filters using DPDK 18.11?

Thanks in advance,
Georgios

Re: [dpdk-dev] Flow Director vs. 5-tuple filters on a 10GbE Intel 82599 ES NIC

[Georgios Katsikas]

This is a kind reminder for my question above.

Best regards,
Georgios

On Tue, Dec 4, 2018 at 12:41 PM Georgios Katsikas <katsikas.gp@gmail.com>
wrote:

> Dear all,
>
> I am performing rule installation/deletion benchmarks on a dual port 10
> GbE Intel 82599 ES NIC using DPDK 18.11.
> The benchmark installs increasing number of rules (5 to 8000), measures
> the rule installation rate and latency and then deletes the rules
> (measuring again the rule deletion rate/latency).
> The rule sets comprise of rules with exact matches (no masks involved) as
> follows:
>
> *Simple rule*
> flow create 0 ingress pattern eth / ipv4 dst is 129.72.224.94 / end
> actions queue index 0 / end
>
> *More complicated rule*
> flow create 0 ingress pattern eth / ipv4 dst is 46.54.254.68 src is
> 49.75.141.195 proto is 17 / udp dst is 26561 src is 7242 / end actions
> queue index 0 / end
>
> No matter how simple or complicated the rules are, I am not able to
> install more than 128 rules on this NIC.
>
> *Here comes my question*
>
> According to the specification
> <https://www.intel.com/content/www/us/en/embedded/products/networking/82599-10-gbe-controller-datasheet.html>,
> this NIC can accommodate up to 128 5-tuple filters, which very well agrees
> with my observation above.
> However, the same document states that this NIC can also accommodate up to
> 8000 Flow Director filters.
> What is the practical difference between a 5-tuple and a Flow Director
> rule in this case? How can I exploit these 8k filters using DPDK 18.11?
>
> Thanks in advance,
> Georgios
>
>
>
>

Re: [dpdk-dev] Flow Director vs. 5-tuple filters on a 10GbE Intel 82599 ES NIC

[Tom Barbette]

?CC-ing maintainers.


________________________________
De : Georgios Katsikas <katsikas.gp@gmail.com>
Envoyé : mardi 4 décembre 2018 11:41
À : dev@dpdk.org
Cc : Tom Barbette
Objet : Flow Director vs. 5-tuple filters on a 10GbE Intel 82599 ES NIC

Dear all,

I am performing rule installation/deletion benchmarks on a dual port 10 GbE Intel 82599 ES NIC using DPDK 18.11.
The benchmark installs increasing number of rules (5 to 8000), measures the rule installation rate and latency and then deletes the rules (measuring again the rule deletion rate/latency).
The rule sets comprise of rules with exact matches (no masks involved) as follows:

Simple rule
flow create 0 ingress pattern eth / ipv4 dst is 129.72.224.94 / end actions queue index 0 / end

More complicated rule
flow create 0 ingress pattern eth / ipv4 dst is 46.54.254.68 src is 49.75.141.195 proto is 17 / udp dst is 26561 src is 7242 / end actions queue index 0 / end

No matter how simple or complicated the rules are, I am not able to install more than 128 rules on this NIC.

Here comes my question

According to the specification<https://www.intel.com/content/www/us/en/embedded/products/networking/82599-10-gbe-controller-datasheet.html>, this NIC can accommodate up to 128 5-tuple filters, which very well agrees with my observation above.
However, the same document states that this NIC can also accommodate up to 8000 Flow Director filters.
What is the practical difference between a 5-tuple and a Flow Director rule in this case? How can I exploit these 8k filters using DPDK 18.11?

Thanks in advance,
Georgios

Re: [dpdk-dev] Flow Director vs. 5-tuple filters on a 10GbE Intel 82599 ES NIC

[Georgios Katsikas]

This is a kind reminder to provide some feedback on this topic.

Best regards,
Georgios

On Tue, Dec 11, 2018 at 4:31 PM Tom Barbette <barbette@kth.se> wrote:

> ​CC-ing maintainers.
>
>
> ------------------------------
> *De :* Georgios Katsikas <katsikas.gp@gmail.com>
> *Envoyé :* mardi 4 décembre 2018 11:41
> *À :* dev@dpdk.org
> *Cc :* Tom Barbette
> *Objet :* Flow Director vs. 5-tuple filters on a 10GbE Intel 82599 ES NIC
>
> Dear all,
>
> I am performing rule installation/deletion benchmarks on a dual port 10
> GbE Intel 82599 ES NIC using DPDK 18.11.
> The benchmark installs increasing number of rules (5 to 8000), measures
> the rule installation rate and latency and then deletes the rules
> (measuring again the rule deletion rate/latency).
> The rule sets comprise of rules with exact matches (no masks involved) as
> follows:
>
> *Simple rule*
> flow create 0 ingress pattern eth / ipv4 dst is 129.72.224.94 / end
> actions queue index 0 / end
>
> *More complicated rule*
> flow create 0 ingress pattern eth / ipv4 dst is 46.54.254.68 src is
> 49.75.141.195 proto is 17 / udp dst is 26561 src is 7242 / end actions
> queue index 0 / end
>
> No matter how simple or complicated the rules are, I am not able to
> install more than 128 rules on this NIC.
>
> *Here comes my question*
>
> According to the specification
> <https://www.intel.com/content/www/us/en/embedded/products/networking/82599-10-gbe-controller-datasheet.html>,
> this NIC can accommodate up to 128 5-tuple filters, which very well agrees
> with my observation above.
> However, the same document states that this NIC can also accommodate up to
> 8000 Flow Director filters.
> What is the practical difference between a 5-tuple and a Flow Director
> rule in this case? How can I exploit these 8k filters using DPDK 18.11?
>
> Thanks in advance,
> Georgios
>
>
>
>

Re: [dpdk-dev] Flow Director vs. 5-tuple filters on a 10GbE Intel 82599 ES NIC

[Tom Barbette]

Hi Georgios,

I looked at the documentation written in C...

ixgbe will first parse the rule as a 5-tuple filter. If parsing works, 
then it will install it as a 5-tuple filter. Then it will try ethertype 
filters, then syn filters, and if any of those "specific" filters did 
not work, then it will use fdir.

As far as I see, there is no way to prevent using 5-tuple/ntuple filters 
if the filter can match.

So currently one is limited to 128 5-tuple flows, while actually 8K 
could be used... Maybe a flag could be added to select the underlying 
hardware, but given ixgbe is getting old and the lack of answer, I doubt 
Intel will help on this...

Tom

PS: If some fields are missing (eg. no dst port), then it seems the 
ntuple will not be used and the parsing will continue. Maybe that can be 
used as a trick ? But it leads to potential collisions...




On 2018-12-11 15:31, Tom Barbette wrote:
> ?CC-ing maintainers.
> 
> 
> ________________________________
> De : Georgios Katsikas <katsikas.gp@gmail.com>
> Envoyé : mardi 4 décembre 2018 11:41
> À : dev@dpdk.org
> Cc : Tom Barbette
> Objet : Flow Director vs. 5-tuple filters on a 10GbE Intel 82599 ES NIC
> 
> Dear all,
> 
> I am performing rule installation/deletion benchmarks on a dual port 10 GbE Intel 82599 ES NIC using DPDK 18.11.
> The benchmark installs increasing number of rules (5 to 8000), measures the rule installation rate and latency and then deletes the rules (measuring again the rule deletion rate/latency).
> The rule sets comprise of rules with exact matches (no masks involved) as follows:
> 
> Simple rule
> flow create 0 ingress pattern eth / ipv4 dst is 129.72.224.94 / end actions queue index 0 / end
> 
> More complicated rule
> flow create 0 ingress pattern eth / ipv4 dst is 46.54.254.68 src is 49.75.141.195 proto is 17 / udp dst is 26561 src is 7242 / end actions queue index 0 / end
> 
> No matter how simple or complicated the rules are, I am not able to install more than 128 rules on this NIC.
> 
> Here comes my question
> 
> According to the specification<https://www.intel.com/content/www/us/en/embedded/products/networking/82599-10-gbe-controller-datasheet.html>, this NIC can accommodate up to 128 5-tuple filters, which very well agrees with my observation above.
> However, the same document states that this NIC can also accommodate up to 8000 Flow Director filters.
> What is the practical difference between a 5-tuple and a Flow Director rule in this case? How can I exploit these 8k filters using DPDK 18.11?
> 
> Thanks in advance,
> Georgios
> 
> 
>