We should first separate between the FW instance handling the connection, and HyperFlow cores doing DPI processing. The only thing that is being shared between each FW instance and HyperFlow cores is relevant data for the DPI jobs to be processed in parallel.
Streaming and blade logic layer is still being handled by the FW instance owning the connection.
Packet flow design description:
- This example showcases a single data packet flow
- In this case, FW instance 1 is the connection owner
- PPE Manager dispatches DPI jobs to PPE workers
- Once the last job is done, a message is sent to FW, notifying that the DPI processing has been completed, allowing it to continue to outbound processing
- PPE Manager can dispatch jobs to any PPE worker, even for the same connection, allowing multiple buffer’s jobs of the same connection to be processed concurrently
o For example, multiple PM jobs of different buffers of the same connection can run concurrently on different PPE workers
Regarding FW monitor, it is a networking focused tool (output can be parsed by wireshark, for example), as such, it is built to work with packets as a whole.
Since HyperFlow works at the parser level, which dissects the TCP data into different segments, it uses other monitoring tools, such as connection tracker.