【Hillstone InsightsASIC】•Article 7
Are you as steady as a mountain in the face of the “Elephant Flow” of data?
In the wave of digitalization, a flood of data sweeps across various industries. Among this traffic, there is a particularly special type known as“Elephant Flow”— those long-lasting, massive single data streams. They are not light “cars,” but heavy “trucks” that, once they appear, occupy the “lane” for a long time, consuming a large amount of network resources. Whether in the financial sector’s cross-regional disaster recovery, operators’ backbone network distribution, or internet cloud storage synchronization and ultra-high-definition video transmission, Elephant Flow is almost ubiquitous, becoming a key challenge affecting network stability and business continuity.
How does the “Elephant Flow” break the CPU’s “soft spot”?
In the face of the impact of “Elephant Flow,” traditional firewall architectures appear inadequate. Traditional firewalls rely on general-purpose CPUs for software forwarding, and their multi-core performance depends on theRSS (Receive Side Scaling) mechanism. Under normal traffic conditions, this mechanism can distribute traffic from different sessions across multiple CPU cores for parallel processing, achieving considerable efficiency. However, once faced with “Elephant Flow,” the limitations of its underlying architecture are exposed, directly threatening business stability.
The core bottleneck lies in the “single queue-single core” binding model designed to ensure packet order. Specifically:
-
Fixed hashing, single core under pressure: The network card hashes traffic to different receive queues based on the five-tuple information using RSS technology. Due to the fixed five-tuple of “Elephant Flow,” its massive packets are continuously directed to the same receive queue.
-
Resource monopolization, multi-core idle: This receive queue is pre-bound to a specific CPU core. This means that the enormous processing pressure of the entire “Elephant Flow” will be borne solely by a single CPU core, while other numerous computing cores in the device remain idle and unable to participate in processing.
-
Business congestion, performance plummeting: The processing capacity of a single CPU core has a physical limit. When the traffic of “Elephant Flow” exceeds this limit, that core will be 100% occupied, preventing it from timely processing other normal business traffic on the same queue, leading to massive network delays and packet loss..
ASIC Hard-Core Acceleration: The “Core” Secret to Taming the Data Behemoth
The Hillstone Networks ASIC firewall was born to solve the processing challenges of “Elephant Flow.” It does not solely rely on general-purpose CPU architecture but is equipped with a dedicatedASIC security chip specifically designed for high-speed data forwarding. Through a hardware-level fast path and slow path separation mechanism, combined with dynamic traffic scheduling technology, it fundamentally breaks through the single-core performance bottleneck caused by Elephant Flow.
-
Hardware-level acceleration: The ASIC security chip integrates dedicated data processing units, solidifying basic network functions such as routing forwarding and NAT in hardware logic, achieving microsecond-level line-speed forwarding, capable of handling 80Gbps of Elephant Flow. The CPU focuses on control-level tasks such as session first packet processing, policy management, and application identification, no longer bearing the heavy load of large traffic data forwarding. In actual operation, over 99% of packets in the Elephant Flow are processed at high speed directly by the ASIC chip, efficiently breaking through the single-core performance bottleneck and ensuring overall network high throughput and low latency.
-
Zero packet loss and high stability: Thanks to the hardware advantages of the ASIC security chip, the Hillstone Networks ASIC firewall can achieve ultra-high throughput performance, ensuring network performance stability even in the face of massive “Elephant Flow” impacts, achieving zero packet loss and ensuring business continuity and reliability.
-
Throughput and security coexist: While processing “Elephant Flow,” the ASIC security chip can simultaneously perform critical security policy checks, achieving a perfect balance between performance and security, ensuring smooth business operations while effectively resisting various network threats.
Performance and security coexist, safeguarding core business
It can be seen that the dilemma faced by traditional firewalls in front of “Elephant Flow” is precisely where the value of the Hillstone Networks ASIC firewall lies. By utilizing the ASIC security chip, it liberates the CPU from heavy forwarding tasks, endowing the network with unprecedented high throughput, low latency, and high stability. This allows it to shine in various industry scenarios: in the financial sector, it can ensure stable and fast daily TB-level data synchronization; in operator networks, it can achieve zero latency in backbone network data distribution; in the film and television industry, it can ensure smooth ultra-high-definition video transmission without stuttering. It is not just a hardware security device but a “guardian” providing solid protection for enterprises’ massive data transmission.
- Product Launch: The Transformation and Market Response of the “Core” Generation of Network Security Products
- Ready to Go: The Tense Preparations and Future Prospects on the Eve of Hillstone Networks’ ASIC Tape-Out
- Technical Breakthrough: A Review of Key Breakthroughs and Innovations in Hillstone Networks’ ASIC Chip
Hillstone Networks is a leading technology innovator in China’s cybersecurity industry, founded in 2007 by a group of well-known cybersecurity technology experts, and became one of the first cybersecurity companies to be listed on the Science and Technology Innovation Board in September 2019 (stock name: Hillstone Networks, stock code: 688030).Currently, Hillstone Networks holds 30 core technologies developed independently and has applied for over 570 domestic and international patents. Since 2019, Hillstone Networks has actively laid out in the field of information innovation, committed to promoting domestic information technology innovation, and officially launched its security chip strategy in 2021. In 2023, it began the technical research and development of self-developed ASIC security chips, aiming to provide users with more efficient and secure cybersecurity protection through independent innovation. At present, Hillstone Networks has formed a complete solution involving ten categories of products and services characterized by “holographic, quantitative, intelligent, and collaborative,” covering infrastructure security, cloud security, data security, application security, security operations, industrial internet security, information technology application innovation, AI security, security services, and security education, across more than 50 industries and scenarios.