Hacker News Reader

Comment by Cyph0n | Hacker News Reader

> If that is the case, my condolences.

As a software engineer working on IOS-XR, that gave me a chuckle :p

In the case of enterprise- and SP-grade routers, the data-plane - i.e., where the actual forwarding and lookups take place - runs entirely on a dedicated network processor (NP), mainly for performance reasons. Information on the NP is populated by the router's operating system in response to user configuration, network topology changes, or protocol state updates. On the other hand, the control plane runs mainly on the CPU(s). This is required so that the protocols running on the router OS (e.g., BGP) can receive and send out updates based on their state machines.

View on HN

> As a software engineer working on IOS-XR, that gave me a chuckle :p

Good good :D

Thanks for the clear data plane / control plane explanation, that's a good way to summarise the distinction. May I link to it from the article?

Thanks! Sure, go ahead!

I think the simplest way for people familiar with PCs to visualize it are the FirePOWER devices. Network cards plugged into some slot have embedded chips which can be programmed to, say, filter specific kinds of traffic, or pass it onto the host CPU for more advanced logic. While the machine's central CPU runs a web interface, manages local databases, downloads updates, manages clusters, records metrics, etc. And either can even be hot-pluggable, interchangeable blades in a larger machine chassis.

Protocol-wise, isn't it common now for the NP on higher end stuff to handle L4 and higher protocols? Or are those still largely managed by the CPU?

Yeah, NPs can handle L4 protocols, but I believe it’s usually a hybrid approach where the logic is split between CPU and NP.

NPs are generally ASICs so it depends on how flexible the code needs to be that is being executed. If it gets outside of the parameters of what the ASICs can handle it can severely limit performance.

An interesting side effect is a lot of the time the tools running on the main CPU don't have visibility into what is happening on the ASICs as the code doesn't have hooks into the data path at all- it compiles the code and sends it down but it doesn't participate much after it starts executing.

Reply on news.ycombinator.com