Symmetric RSS (Receive-Side Scaling)

New direction. This is just damn cool. These folks have written some custom drivers that exploit collisions in the original RSS (Receive-Side Scaling) load-balancing algorithm developed by Microsoft,  such that the RX queues on the NIC end up getting properly 5-tuple load-balanced. This allows a monitoring tool to leverage the locality of reference and cache coherency inherent with having both sides of a given connection being steered to discrete CPU cores for analysis. By manipulating the secret key used in the cryptographic hash function employed by RSS, these researchers appear to have achieved IDS-optimized load-balancing completely in hardware using commodity network cards:

http://www.ndsl.kaist.edu/~shinae/papers/TR-symRSS.pdf

I need to see how this compares with similar work by Luca Deri and friends:

http://www.ntop.org/pf_ring/hardware-based-symmetric-flow-balancing-in-dna/

On the plus side, this technique appears to have already made it into the code for the DNA drivers, and a patch has recently been committed to enable this functionality for libpcap-based applications:

http://listgateway.unipi.it/pipermail/ntop-misc/2012-July/003037.html

Unfortunately, at present it seems that the DNA drivers can only be used by one network monitoring application at a time. None of this inherently solves my virtualization problem, but it's a big step in the right direction.

Stay tuned...