Flow Cache Design for Improving Traffic Collection in NP-Based Network Monitor System

In this paper we describe the design consideration and implementation of flow cache architecture based on IXP2400 network processor in SCUT. Network traffic collection provides real world data for further performance analysis and that therefore make it very important for network management and monitoring. However, the design of such a high performance system with efficient flow cache data structure is not trivial in today´s high speed and large volume network environment, especially in a resource constrains Intel IXP2400 network processor platform. After comparing various design options, we adapted from hash table combining binary search tree data structure, employing the special hardware unit assist to calculate hash value. Inspired by unix block buffer approach, we further refined our proposed flow cache scheme that not only caches the result from flow collection but also speed up the flow update procedure. By theoretical analysis and careful engineering design, we finally concluded that a combination of a hash table with binary search tree and a group linked free buffer list with caching provides us a remarkable performance gain.