Network interface card rate limiting

Patent metadata

Field	Value
Publication number	US-10212129-B2
Application number	US-201715454887-A
Country	US
Kind code	B2
Filing date	Mar 9, 2017
Priority date	May 19, 2014
Publication date	Feb 19, 2019
Grant date	Feb 19, 2019

Abstract

Systems and methods for limiting the rate of packet transmission from a NIC to a host CPU are provided. According to one embodiment, data packets are received from a network by the NIC. The NIC is coupled to a host central processing unit (CPU) of a network security device through a bus. A status of the host CPU is monitored by the NIC. A rate limiting mode indicator is set by the NIC based on the status. When the rate limiting mode indicator indicates rate limiting is inactive, then the received data packets are delivered or made available to the host CPU for processing. When the rate limiting mode indicator indicates rate limiting is active, then rate limiting is performing by temporarily stopping or slowing the delivery or making available of the received data packets to the host CPU for processing.

First claim

What is claimed is:

1. A method comprising:
receiving, by a network interface card (NIC) of a network security device, data packets from or directed to a private network protected by the network security device, wherein the NIC is coupled to a host central processing unit (CPU) of the network security device through a bus;
monitoring, by the NIC, a status of the host CPU, including:
responsive to receiving a data packet, notifying the host CPU the data packet is available for processing by the host CPU, by issuing, by the NIC, an interrupt to the host CPU;
disabling, by the NIC, the interrupt;
measuring, by the NIC, a time period during which the interrupt remains disabled by monitoring the interrupt; and
determining, by the NIC, the host CPU is busy when the time period exceeds a predetermined or configurable time threshold;

setting, by the NIC, a rate limiting mode indicator based on the status;
when the rate limiting mode indicator indicates rate limiting is inactive, then causing, by the NIC, the host CPU to perform one or more high priority tasks in relation to the received data packets within a kernel of an operating system of the host CPU by delivering or making available the received data packets to the host CPU; and
when the rate limiting mode indicator indicates rate limiting is active, then avoiding starving of one or more lower priority tasks of host CPU cycles by, the NIC, temporarily stopping or slowing said delivering or making available the received data packets to the host CPU.

2. The method of claim 1 , wherein said monitoring, by the NIC, a status of the host CPU further comprises:
monitoring, by the NIC, a length of a data packet queue maintained by the NIC, wherein the data packet queue is used for storing those of the received data packets that cannot be immediately processed by the host CPU; and
determining, by the NIC, the host CPU is busy when the length exceeds a predetermined or configurable length threshold.

3. The method of claim 1 , further comprising:
after determining the host CPU is busy, continuing to monitor, by the NIC, the interrupt; and
when the interrupt is observed to be re-enabled, then:
determining, by the NIC, the host CPU is no longer busy; and
resuming said delivering or making available the received data packets to the host CPU after a predetermined or configurable amount of time, thereby allowing the host CPU to perform the one or more lower priority tasks.

4. The method of claim 2 , further comprising:
after determining the host CPU is busy, continuing to monitor, by the NIC, the length of the data packet queue; and
when the length is equal to or less than the predetermined or configurable length threshold, then:
determining, by the NIC, the host CPU is no longer busy; and
resuming said delivering or making available the received data packets to the host CPU after a predetermined or configurable amount of time, thereby allowing the host CPU to perform the one or more lower priority tasks.

5. The method of claim 1 , wherein said setting a rate limiting mode indicator based on the status is performed by a first process running on the NIC and wherein said delivering or making available the received data packets to the host CPU and said rate limiting is performed by a second process running on the NIC.

6. The method of claim 1 , wherein said temporarily stopping or slowing said delivering or making available the received data packets to the host CPU comprises buffering, by the NIC, the received data packets.

7. The method of claim 1 , further comprising:
determining, by the NIC, a relative priority of each of the received data packets; and
wherein said temporarily stopping or slowing said delivering or making available the received data packets to the host CPU comprises (i) buffering, by the NIC, those of the received data packets determined to have a relatively high priority; and (ii) dropping, by the NIC, those of the received data packets determined to have a relatively low priority.

8. The method of claim 7 , wherein said determining a relative priority of each of the received data packets is based on a protocol associated with the received data packets.

9. The method of claim 1 , wherein the network security device comprises unified threat management (UTM) appliance, a firewall device or a gateway device.

10. The method of claim 9 , wherein the one or more high priority tasks include performing security scanning on the received data packets.

11. The method of claim 9 , wherein the one or more low priority tasks include execution of a user space application.

12. A programmable network interface controller (NIC) of a network security device comprising:
a non-transitory storage device having embodied therein instructions representing a processor status monitoring routine and a packet delivery routine; and
one or more processors coupled to the non-transitory storage device and operable to execute the processor status monitoring routine and the packet delivery routine to perform a method comprising:
receiving data packets from or directed to a private network protected by the network security device, wherein the NIC is coupled to a host central processing unit (CPU) of the network security device through a bus;
monitoring, by the processor status monitoring routine, a status of the host CPU, including:
responsive to receiving a data packet, notifying the host CPU the data packet is available for processing by the host CPU, by issuing an interrupt to the host CPU;
disabling the interrupt;
measuring a time period during which the interrupt remains disabled by monitoring the interrupt; and
determining the host CPU is busy when the time period exceeds a predetermined or configurable time threshold;

setting, by the processor status monitoring routine, a rate limiting mode indicator based on the status;
when the rate limiting mode indicator indicates rate limiting is inactive, then causing, by the packet delivery routine, the host CPU to perform one or more high priority tasks in relation to the received data packets within a kernel of an operating system of the host CPU by delivering or making available the received data packets to the host CPU; and
when the rate limiting mode indicator indicates rate limiting is active, then avoiding starving of one or more lower priority tasks of host CPU cycles by, the packet delivery routine, temporarily stopping or slowing said delivering or making available the received data packets to the host CPU.

13. The programmable NIC of claim 12 , wherein said monitoring, by the processor status monitoring routine, a status of the host CPU further comprises:
monitoring a length of a data packet queue maintained by the NIC, wherein the data packet queue is used for storing those of the received data packets that cannot be immediately processed by the host CPU; and
determining the host CPU is busy when the length exceeds a predetermined or configurable length threshold.

14. The programmable NIC of claim 12 , further comprising:
after determining the host CPU is busy, continuing to monitor, by the processor status monitoring routine, the interrupt; and
when the interrupt is observed to be re-enabled, then:
determining the host CPU is no longer busy; and
resuming said delivering or making available the received data packets to the host CPU after a predetermined or configurable amount of time, thereby allowing the host CPU to perform the one or more lower priority tasks.

15. The programmable NIC of claim 13 , wherein the method further comprises:
after determining the host CPU is busy, continuing

Assignees

• Fortinet Inc

Inventors

• Dai Zhiwei
• Zhou Xu

Classifications

• H04L43/08

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title

• G06F13/28

  using burst mode transfer, e.g. direct memory access {DMA}, cycle steal (G06F13/32 takes precedence) · CPC title

• H04L63/0272

  Virtual private networks · CPC title

• G06F15/7825

  Globally asynchronous, locally synchronous, e.g. network on chip · CPC title

• G06F9/4887

  involving deadlines, e.g. rate based, periodic · CPC title