Accelerating network analytics with an on-NIC streaming engine

Data Stream Processing engines have recently emerged as powerful tools for simplifying the analysis of network telemetry data. Motivated by the ever-growing volume of data requiring analysis, cutting-edge approaches integrate them with programmable switches to filter out less relevant traffic and enhance their processing capabilities. In this paper, we propose an alternative solution: leveraging SmartNICs as high-performance accelerators for stream processing operations. SmartNICs are commonly deployed in datacenter networks, and their architecture is often characterized by numerous low-power processors that align seamlessly with the highly parallelizable computational requirements of standard streaming analysis frameworks. Starting from WindFlow, a state-of-the-art stream processor, we present an innovative architecture that enables the offloading of a portion of its computation to a commodity Netronome SmartNIC. We implemented the offload logic using eBPF, making our solution compatible with any NIC supporting this programming paradigm. We developed a diverse range of applications (i.e., flow metering, port scan detection and SYN flood attack detection) and show that our solution can analyze up to 40% more traffic compared to a pure software approach.