Optimized batched packet processing for deep packet inspection

1. A computer-implemented method, comprising:

receiving a batch of network packets;

performing a stateless processing operation for the batch, comprising:

updating a current time for the batch,

decoding the network packets in the batch,

creating a flow-hash lookup key for each decoded network packet, and

generating a first output comprising the current time and corresponding flow-hash lookup keys for the decoded network packets;

performing a stateful processing operation for the batch, comprising:

accessing the first output of the stateless processing operation,

dividing the batch into a plurality of sub-batches,

performing a parallel flow-hash table lookup operation on the network packets that are part of the plurality of sub-batches, wherein

the parallel flow-hash table lookup operation is a multi-threaded operation that looks up records of packet flows in a hash table, and

the parallel flow-hash table lookup operation inserts a new record in the hash table if a record key is not found and deletes an existing record from the hash table corresponding to a unidirectional packet flow if the hash table has insufficient space for an insertion, and

generating a second output comprising the plurality of sub-batches with associated packet flows; and

performing a deep packet inspection (DPI) processing operation comprising:

accessing the second output of the stateful processing operation, and

performing the DPI processing operation on a per-packet basis or on a per-flow basis.

2. The computer-implemented method of claim 1 , wherein performing the DPI processing operation on the per-packet basis, comprises:

updating packet flow statistics for each network packet that is part of plurality of sub-batches,

performing transport layer state tracking for each network packet, and

performing application layer processing for each network packet.

3. The computer-implemented method of claim 1 , wherein performing the DPI processing on the per-flow basis, comprises:

grouping two or more network packets within each sub-batch of the plurality of sub-batches together if the two or more network packets have a same packet flow,

maintaining an order of the two or more network packets relative to each other within the same packet flow,

updating packet flow statistics for each packet flow,

performing transport layer state tracking for each packet flow followed by each network packet, and

performing application layer processing for each packet flow followed by each network packet.

4. The computer-implemented method of claim 1 , wherein

decoding the network packets in the batch comprises determining one or more internet protocol (IP) addresses, one or more ports, and an IP protocol associated with each of the network packets.

5. The computer-implemented method of claim 1 , wherein

a size of the batch in the first output is less than or equal to another size of the batch prior to performance of the stateless processing operation.

6. The computer-implemented method of claim 1 , further comprising:

comparing the current time with a next time; and

executing a timer bookkeeping operation.

7. The computer-implemented method of claim 3 , wherein

performing the transport layer state tracking comprises applying one or more packet payload transformations for transfer control protocol (TCP).

8. The computer-implemented method of claim 1 , wherein

the batch of network packets are received at a DPI engine that is implemented by a DPI server and executes one or more packet capture mechanisms.

9. A non-transitory computer readable storage medium comprising program instructions executable to:

receive a batch of network packets;

perform a stateless processing operation for the batch, comprising:

updating a current time for the batch,

decoding the network packets in the batch,

creating a flow-hash lookup key for each decoded network packet, and

generating a first output comprising the current time and corresponding flow-hash lookup keys for the decoded network packets;

perform a stateful processing operation for the batch, comprising:

accessing the first output of the stateless processing operation,

dividing the batch into a plurality of sub-batches,

performing a parallel flow-hash table lookup operation on the network packets that are part of the plurality of sub-batches wherein

the parallel flow-hash table lookup operation is a multi-threaded operation that looks up records of packet flows in a hash table, and

the parallel flow-hash table lookup operation inserts a new record in the hash table if a record key is not found and deletes an existing record from the hash table corresponding to a unidirectional packet flow if the hash table has insufficient space for an insertion, and

generating a second output comprising the plurality of sub-batches with associated packet flows; and

perform a deep packet inspection (DPI) processing operation comprising:

accessing the second output of the stateful processing operation, and

performing the DPI processing operation on a per-packet basis or on a per-flow basis.

10. The non-transitory computer readable storage medium of claim 9 , wherein

performing the DPI processing operation on the per-packet basis, comprises:

updating packet flow statistics for each network packet that is part of plurality of sub-batches,

performing transport layer state tracking for each network packet, and

performing application layer processing for each network packet.

11. The non-transitory computer readable storage medium of claim 9 , wherein

performing the DPI processing on the per-flow basis, comprises:

grouping two or more network packets within each sub-batch of the plurality of sub-batches together if the two or more network packets have a same packet flow,

maintaining an order of the two or more network packets relative to each other within the same packet flow,

updating packet flow statistics for each packet flow,

performing transport layer state tracking for each packet flow followed by each network packet, and

performing application layer processing for each packet flow followed by each network packet.

12. A system comprising:

one or more processors; and

a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:

receive a batch of network packets;

perform a stateless processing operation for the batch, comprising:

updating a current time for the batch,

decoding the network packets in the batch,

creating a flow-hash lookup key for each decoded network packet, and

generating a first output comprising the current time and corresponding flow-hash lookup keys for the decoded network packets;

perform a stateful processing operation for the batch, comprising:

accessing the first output of the stateless processing operation,

dividing the batch into a plurality of sub-batches,

performing a parallel flow-hash table lookup operation on the network packets that are part of the plurality of sub-batches, wherein

the parallel flow-hash table lookup operation is a multi-threaded operation that looks up records of packet flows in a hash table, and

the parallel flow-hash table lookup operation inserts a new record in the hash table if a record key is not found and deletes an existing record from the hash table corresponding to a unidirectional packet flow if the hash table has insufficient space for an insertion, and

generating a second output comprising the plurality of sub-batches with associated packet flows; and

perform a deep packet inspection (DPI) processing operation comprising:

accessing the second output of the stateful processing operation, and

performing the DPI processing operation on a per-packet basis or on a per-flow basis.

13. The system of claim 12 , wherein

performing the DPI processing operation on the per-packet basis,

comprises:

updating packet flow statistics for each network packet that is part of plurality of sub-batches,

performing transport layer state tracking for each network packet, and

performing application layer processing for each network packet.

14. The system of claim 12 , wherein

performing the DPI processing on the per-flow basis, comprises:

grouping two or more network packets within each sub-batch of the plurality of sub-batches together if the two or more network packets have a same packet flow,

maintaining an order of the two or more network packets relative to each other within the same packet flow,

updating packet flow statistics for each packet flow,

performing transport layer state tracking for each packet flow followed by each network packet, and

performing application layer processing for each packet flow followed by each network packet.

15. The system of claim 12 , wherein

the parallel flow-hash table lookup operation implements a cuckoo-based hashing algorithm.