基于FPGA的160Gbit/s网络数据包过滤系统设计

Design of 160Gbit/s network packets filtering system based on FPGA

网络流量分析系统是保障网络空间安全的重要技术手段之一,但传统的分析处理系统难以应对海量的网络数据,亟需特定设备对网络数据包进行预过滤处理,以减轻分析处理系统的负担。针对现有需求,设计了一种基于FPGA的160 Gbit/s网络数据包过滤系统。系统首先对16通道输入的网络数据包进行解析,在提取关键字段后,采用哈希表的方式和轮询仲裁机制实现多通道查询,最终过滤输出符合规则的数据包。仿真与板级测试结果表明,系统平均处理延迟为1.5μs,有效过滤比达99.5%以上,满足16通道、单通道10 Gbit/s线速过滤要求。在XC7VX485T芯片上满足40 960条关键字段查询时,存储资源占用不到80%,具有高吞吐、低延迟和高可靠性的特点,在主干网、数据中心等网络安全领域具有一定的实际应用价值。

The network traffic analysis system is an important technology that ensures the security of cyberspace. The traditional analysis system is difficult to deal with the massive amount of data. It is urgent for a specific technology to pre-filter the network data packets in order to reduce the burden of the analysis system. Considering the need, this paper designs a 160 Gbit/s network packets filtering system based on FPGA. The system first parses the input network data packets, extracts the keywords, and then uses a hash table to lookup. A round-robin arbiter is designed for the multi-channel query. Finally, filter and output the packets that meet the requirements. System-level simulation and board-level test results show that the average delay during processing is 1.5 μs, and the effective filtering ratio is over 99.5%, which meets the requirement of 16*10 Gbit/s line-rate filtering. On the XC7 VX485 T FPGA, RAM resources occupy less than 80% when supporting 40 960 keywords queries. The system is high-throughput, low-latency, and high-reliability. It is practical and has great value in network security fields such as backbone networks and data centers.