Automatic reconfiguration of network interface driver on network sensor host
Various embodiments include systems and methods pertaining to a network sensor host configured to implement a receive side scaling (RSS) configuration component in a security environment. The RSS configuration component may be used to automatically generate an RSS configuration comprising one or more settings customized for the network sensor host based at least in part on hardware information of the network sensor host. In some embodiments, the RSS configuration may be applied to change settings of a network interface driver of the network sensor host, e.g., to implement RSS and multithreading for network sensor tasks.
1 . A method, comprising:
determining, at a computing device that hosts a deep packet inspection (DPI) component, a triggering condition to initiate a reconfiguration of a network interface driver of the network interface used by the DPI component to monitor network traffic of a network;
performing the reconfiguration in response to the triggering condition, including:
determining hardware information of the computing device, including:
network interface driver information of the network interface driver; and
processor core information associated with one or more processor cores of the computing device;
automatically generating a receive side scaling (RSS) configuration that includes one or more settings customized for the computing device based at least in part on the hardware information; and
automatically applying the RSS configuration to change one or more settings of the network interface driver.
2 . The method of claim 1 , wherein:
the DPI component is implemented as part of a network sensor; and
the triggering condition comprises a startup of the network sensor or receiving of a configuration change of the network sensor.
3 . The method of claim 1 , further comprising:
responsive to determining that a failure has occurred during the generation or the application of the RSS configuration, applying a fallback RSS configuration.
4 . The method of claim 1 , further comprising:
responsive to determining that a failure has occurred during the generation or the application of the RSS configuration, configuring the network interface driver to implement an initial set of network interface driver settings.
5 . The method of claim 1 , further comprising:
installing a RSS configuration software component on the computing device, wherein the RSS configuration software component executes to monitor for the triggering condition.
6 . The method of claim 1 , further comprising:
executing the deep packet inspection (DPI) component at the computing device to analyze IP packets observed in the network, including source and destination addresses of the IP address and payloads of the IP addresses; and
determining, based on the analysis of the IP packets, one or more of:
a performance measure of the network traffic of the network,
an anomaly in the network traffic,
an indication of malicious activity in the network, or
an indication of an intrusion in the network.
7 . The method of claim 1 , wherein the hardware information of the computing device determined for the reconfiguration includes a total amount of memory available to the DPI component and an amount of memory available to individual processor cores of the computing device.
8 . The method of claim 1 , wherein the reconfiguration comprises:
determining that the computing device has a sufficient number of processor cores to implement multithreading for the DPI component; and
updating the RSS configuration to enable one or more multithreading settings.
9 . The method of claim 8 , wherein the updating the RSS configuration comprises:
assigning a first processor core to a first enabled DPI task; and
assigning a second processor core to a second enabled DPI task.
10 . The method of claim 1 , wherein the reconfiguration comprises:
setting a number of traffic receive queues to be used by the network interface driver.
11 . The method of claim 10 , wherein the reconfiguration comprises:
updating one or more RSS hash functions to control which IP flows are assigned to which traffic receive of queues.
12 . The method of claim 10 , wherein the reconfiguration comprises:
updating one or more interrupt request (IRQ) affinity settings to associate individual traffic receive queues to respective processor cores.
13 . A system comprising:
a computing device that hosts a deep packet inspection (DPI) component that monitors network traffic of a network, configured to:
determine a triggering condition has occurred to initiate a reconfiguration of a network interface driver of the network interface used by the DPI component;
perform the reconfiguration in response to the triggering condition, including to:
determine hardware information of the computing device, including:
network interface driver information of the network interface driver; and
processor core information associated with one or more processor cores of the computing device;
automatically generate a receive side scaling (RSS) configuration that includes one or more settings customized for the computing device based at least in part on the hardware information; and
automatically apply the RSS configuration to change one or more settings of the network interface driver.
14 . The system of claim 13 , wherein:
the DPI component is implemented as part of a network sensor; and
the triggering condition comprises a startup of the network sensor or receiving of a configuration change of the network sensor.
15 . The system of claim 13 , wherein the computing device is configured to:
execute a RSS configuration software component to monitor for the triggering condition.
16 . The system of claim 13 , wherein the computing device is configured to:
execute the deep packet inspection (DPI) component to analyze IP packets observed in the network, including source and destination addresses of the IP address and payloads of the IP addresses; and
determine, based on the analysis of the IP packets, one or more of:
a performance measure of the network traffic of the network,
an anomaly in the network traffic,
an indication of malicious activity in the network, or
an indication of an intrusion in the network.
17 . The system of claim 13 , wherein the hardware information of the computing device determined for the reconfiguration includes a total amount of memory available to the DPI component and an amount of memory available to individual processor cores of the computing device.
18 . The system of claim 13 , wherein to perform the reconfiguration, the computing device is configured to:
determine that the computing device has a sufficient number of processor cores to implement multithreading for the DPI component; and
update the RSS configuration to enable one or more multithreading settings.
19 . The system of claim 13 , wherein to perform the reconfiguration, the computing device is configured to:
set a number of traffic receive queues to be used by the network interface driver.
20 . The system of claim 19 , wherein to perform the reconfiguration, the computing device is configured to:
update one or more interrupt request (IRQ) affinity settings to associate individual traffic receive queues to respective processor cores.