7x Wireshark Performance Increase
Napatech Link™ Capture Software
for Intel® PAC with Intel Arria® 10 GX FPGA
Napatech Link™ Capture Software for Intel® PAC
Napatech has created a hardware acceleration solution that alleviates the load on the CPU and thereby greatly increases Wireshark performance. This has been achieved by making the industry-leading Napatech Link™ Capture Software available for the Intel® Programmable Acceleration Card (PAC) with Intel Arria® 10 GX FPGA.
The software’s intelligent feature set offloads processing and analysis of Ethernet data from application software, while ensuring optimal use of the standard server’s resources leading to outstanding application acceleration. Other capabilities include network traffic capture at full line rate, with zero-loss packet capture, hardware timestamping and tunneling support, all on an Intel PAC.
The solution dramatically increases capture and protocol analysis, allowing network engineers to utilize the full power of Wireshark to understand network traffic, find anomalies, and diagnose network issues at incredible speeds.
Key Solution Features
• Lossless capture and protocol decode for up to 13 Gbps on a single thread for traffic analysis, inspection and detection
• Onboard packet buffering during micro-burst or PCI Express bus congestion scenarios
• Advanced host memory buffer management enabling ultra-high CPU cache performance
• Packet classification, match/action filtering and zero-copy forwarding
• Intelligent and flexible load distribution to 64 queues improving CPU cache performance by always delivering the same flows to the same cores
The challenge for Wireshark users
Wireshark is a widely-used network protocol analyzer allowing users to see what is happening on their networks at a microscopic level. It is the de facto standard across many commercial and non-profit enterprises, government agencies, and educational institutions for troubleshooting and protocol analysis.
Wireshark has a rich feature set including deep inspection of hundreds of protocols, live capture and offline analysis. However, as capable as Wireshark is at inspecting and analyzing network protocols, it will only be as effective as its implementation.
The ability to capture and analyze traffic at lossless rates is of the utmost importance for Wireshark to be successful. To decode all traffic, it is a fundamental requirement that Wireshark “sees everything”. If any traffic is missed, full protocol analysis is not possible. And if the capture server is overburdened and too slow to handle the incoming packet rate, packets are discarded, and information lost forever.
But examining the contents of every network packet is extremely CPU-intensive, especially for a multi-gigabit traffic load. And this is the limiting factor in Wireshark performance: the packet processing on the CPU.
In addressing this challenge, Napatech has created a hardware acceleration solution that alleviates the load on the CPU and thereby greatly increases Wireshark performance. This has been achieved by making the Napatech Link™ Capture Software available as an Acceleration Stack for the Intel® PAC with Intel Arria® 10 GX FPGA.
The Intel / Napatech difference
The Intel PAC and Napatech Link™ Capture Software solution dramatically increases capture and protocol analysis, allowing network engineers to utilize the full power of Wireshark to understand network traffic, find anomalies, and diagnose network issues at incredible speeds. The solution offloads processing and analysis of networking traffic from the application software, while ensuring optimal use of the standard server’s resources leading to effective Wireshark acceleration.
Outstanding Lossless Performance
Optimized to capture all network traffic at full line rate, with almost no CPU load on the host server, the solution demonstrates enormous lossless performance advantages for Wireshark: up to 7x lossless capture and decode performance compared to a standard network interface card (NIC).
Turning acceleration into value
These performance advantages ultimately allow you to:
• Maximize your server performance by improving CPUutilization
• Minimize your TCO by reducing number of serversneeded, thus optimizing rack space, power, coolingand operational expenses
• Diminish your time-to-resolution, thereby enablinggreatly increased efficiency
Lossless throughput tests
For the lossless throughput test, traffic was sent at fixed rates and packet sizes and throughput was measured as the rate at which Wireshark is able to receive and analyze the packets.
The outstanding improvements achieved with this solution were demonstrated by comparing Wireshark performance running on a Dell PowerEdge R740 with a standard 40G NIC card and the Intel PAC A10. Test configuration: dual-socket Dell R740 with Intel® Xeon® Gold 6138 2.0 GHz, 128GB RAM running CentOS 7.5.
Wireshark Lossless Throughput
Lossless Receive Rate (Gbps)
- Standard NIC
- Intel PAC A10
Input Frame Size (B)
Up to 7 times lossless capture performance compared to a standard NIC
Additional testing for “back-to-back frames” was applied as described in the RFC 2544 benchmarking methodology to send a burst of frames with minimum inter-frame gaps to the Device Under Test (DUT) and count the number of frames received/forwarded by the DUT. The back-to-back value was defined as the number of frames in the longest burst that the DUT could handle without the loss of any frames. The Intel and Napatech solution proved over 100 times better in this test configuration.