Hyperscan Performance Benchmark on Intel Xeon Processors

The requirement for advanced security equipment to scan data streams for malicious content at line rate presents significant challenges to network security vendors. Overwhelmed by the data rates of present-day networks, security equipment is more likely to miss attacks, leading to increased risk of security breaches. While high-speed content scanning, also known as deep packet inspection (DPI), exists today, this technology typically requires purpose-built hardware to operate at high speeds, a solution that often leads to increases in development and manufacturing costs. A software-based approach that takes advantage of multi-core Intel® architecture can provide a cost-effective and scalable solution that also has the flexibility to evolve with the changing needs of the system. The Hyperscan software pattern matching library, designed for both single core and multi-core processors, offers a software-based DPI solution that can scale from under 1 Gbps up to 160 Gbps, depending on the number of cores used. By integrating DPI technology optimized for multi-core processors, Hyperscan provides a cost-effective software solution for scanning data content at line rate in security equipment ranging from small network appliances to large network elements. DEEP PACKET INSPECTION Newer processor architectures with higher clock rates, larger caches, and other advances have enabled network security equipment to incorporate capabilities previously found only in end systems. No longer limited to just bridging and forwarding, network elements are now scanning packets as they pass through. Taking advantage of this technology, network administrators now deploy intrusion detection and prevention systems (IDS and IPS) and network anti-virus and malware scanners alongside the traditional firewall. In some cases, several security functions are incorporated into a universal threat management (UTM) appliance. Unlike the traditional firewall that looks at packet headers only, this more advanced type of equipment uses DPI technology to examine the content of each packet to detect threats. Instead of basing security decisions solely on fields in the packet header, DPI technology allows a security application to peer deep into the contents of a data stream to try to identify harmful intent. This more detailed examination of the data stream has an added cost, however, as scanning the content of data streams is CPU-intensive and can become unfeasible as the traffic load increases. The efficacy of DPI as a tool, therefore, depends largely on how well it performs under load. A system that performs flawlessly under contrived theoretical conditions but fails under heavy traffic presents a major …