Re: Flow Director vs. 5-tuple filters on a 10GbE Intel 82599 ES NIC

[Tom Barbette <barbette@kth.se>]

Hi Georgios,

I looked at the documentation written in C...

ixgbe will first parse the rule as a 5-tuple filter. If parsing works, 
then it will install it as a 5-tuple filter. Then it will try ethertype 
filters, then syn filters, and if any of those "specific" filters did 
not work, then it will use fdir.

As far as I see, there is no way to prevent using 5-tuple/ntuple filters 
if the filter can match.

So currently one is limited to 128 5-tuple flows, while actually 8K 
could be used... Maybe a flag could be added to select the underlying 
hardware, but given ixgbe is getting old and the lack of answer, I doubt 
Intel will help on this...

Tom

PS: If some fields are missing (eg. no dst port), then it seems the 
ntuple will not be used and the parsing will continue. Maybe that can be 
used as a trick ? But it leads to potential collisions...




On 2018-12-11 15:31, Tom Barbette wrote:
> ?CC-ing maintainers.
> 
> 
> ________________________________
> De : Georgios Katsikas <katsikas.gp@gmail.com>
> Envoyé : mardi 4 décembre 2018 11:41
> À : dev@dpdk.org
> Cc : Tom Barbette
> Objet : Flow Director vs. 5-tuple filters on a 10GbE Intel 82599 ES NIC
> 
> Dear all,
> 
> I am performing rule installation/deletion benchmarks on a dual port 10 GbE Intel 82599 ES NIC using DPDK 18.11.
> The benchmark installs increasing number of rules (5 to 8000), measures the rule installation rate and latency and then deletes the rules (measuring again the rule deletion rate/latency).
> The rule sets comprise of rules with exact matches (no masks involved) as follows:
> 
> Simple rule
> flow create 0 ingress pattern eth / ipv4 dst is 129.72.224.94 / end actions queue index 0 / end
> 
> More complicated rule
> flow create 0 ingress pattern eth / ipv4 dst is 46.54.254.68 src is 49.75.141.195 proto is 17 / udp dst is 26561 src is 7242 / end actions queue index 0 / end
> 
> No matter how simple or complicated the rules are, I am not able to install more than 128 rules on this NIC.
> 
> Here comes my question
> 
> According to the specification<https://www.intel.com/content/www/us/en/embedded/products/networking/82599-10-gbe-controller-datasheet.html>, this NIC can accommodate up to 128 5-tuple filters, which very well agrees with my observation above.
> However, the same document states that this NIC can also accommodate up to 8000 Flow Director filters.
> What is the practical difference between a 5-tuple and a Flow Director rule in this case? How can I exploit these 8k filters using DPDK 18.11?
> 
> Thanks in advance,
> Georgios
> 
> 
>