External monitoring of highly parallel network processors

Modern routers use high-performance multi-core packet processing systems to implement protocol operations and to forward traffic. As the diversity of protocols and the number of processor cores increases, it becomes increasingly difficult to manage these systems and ensure their correct operation at runtime. In particular, it is challenging to identify situations in which a part of processor cores behave incorrectly, either due to failure or due to malicious attacks. To address this problem, we present a novel approach to verifying correct operation of a packet processor by analyzing packet latency and throughput. This approach can treat the network processor as a “black box” and does not need to observe internal functionality. We show that processing time statistics are affected by system misbehavior and present an analytic model to quantify these effects. Our results show that the presented technique is an effective approach to provide an extra level of protection to packet processor systems.