As network traffic volumes grow, network security solutions must inspect and filter packets without creating additional processing bottlenecks. Traditional software based Network Intrusion Prevention Systems (NIPS) rely on host CPU resources for packet inspection and threat detection, potentially increasing processing overhead under demanding workloads.
iWave demonstrates an FPGA based network intrusion prevention approach using P4-programmable packet filtering on its iW-Fibre SmartNIC platform. By offloading selected signature matching and packet filtering operations to the FPGA datapath, the solution can drop packets matching configured security rules while forwarding non matching traffic. This approach helps reduce host CPU involvement in selected network security operations.
FPGA-Accelerated Network Security with iWave SmartNIC
iWave addresses high-performance network security requirements through P4-based network intrusion prevention using FPGA technology on its iW-Fibre SmartNIC platform. Powered by an Altera FPGA, the solution implements programmable packet filtering directly in the hardware datapath, enabling configured malicious packet signatures to be identified and filtered before reaching the host.
Packets matching the configured test signature are assigned a drop action, while non-matching traffic is forwarded. This hardware-assisted approach demonstrates how selected network intrusion prevention functions can be offloaded from the host CPU to an FPGA-based PCIe accelerator.
Architecture and Implementation
The iW-Fibre SmartNIC demonstrates P4-based packet filtering on an FPGA SmartNIC, combining programmable packet processing with hardware assisted security enforcement. This FPGA accelerated packet inspection and filtering approach evaluates configured protocol, destination port and payload pattern conditions to determine whether packets should be dropped or forwarded.
The architecture comprises three key components:
- P4-based packet processing: Incoming packets are evaluated against configured protocol, destination port and payload pattern conditions.
- Hardware enforcement: Packets matching the configured malicious signature are dropped, while non-matching packets are forwarded.
Host-based monitoring: Host software generates test traffic and uses Suricata to monitor received packets and verify the filtering behavior.
Test Setup and Performance Observations
Figure 1: Test Setup
To evaluate the impact of P4-based NIPS offload, testing was performed on the iWave G51-AFibre-200G SmartNIC in two configurations: with P4 filtering disabled and with P4 filtering enabled. The tests used a host generated traffic workload containing benign packets and packets matching a configured Synful Knock test signature. benign packets have been logged on host through Suricata Application
Table 1: Test Environment
1.Without P4 Filtering
With P4 filtering disabled, the host-side traffic generator transmitted the test packets without the configured P4 match action filtering. Host CPU utilization was monitored before and during packet transmission using htop application and benign packets have been logged on host through Suricata Application.
The measurements show the host resource utilization associated with the baseline traffic-generation configuration.
Figure 2. Host CPU utilization before packet transmission with P4 filtering disabled – maximum observed individual-core utilization: 0.7%.
Figure 3. Host CPU utilization during packet transmission with P4 filtering disabled – maximum observed individual-core utilization: 42.4%.
Figure 4. Host Logging- Suricata Application detecting SYNful knack packets reaching host
2. iWave PCIe Accelerator card With P4-Based NIPS Offload
With P4 filtering enabled, packet processing rules were configured in the FPGA to identify the Synful Knock test signature using TCP protocol, destination port 4789 and a payload pattern match. Packets matching the configured rule were assigned a Drop action, while non-matching TCP traffic was assigned a Forward action.
Table 2 . P4 match-action configuration
During this test, 1.0% CPU usage was recorded for the NIPS offload configuration. This is the observed value for the reported test, rather than a general performance guarantee.
Figure 5: CPU utilization during NIPS hardware offload
Suricata was configured with a rule to alert if the test malicious traffic reached the host. No alert was triggered for the configured signature during the reported test.
Figure 6: Host Logging- Suricata application does not trigger SYNful knack packet reaching host during P4 NIPS enabled test
Summary of tests Conducted
The comparison demonstrates the impact of enabling P4-based NIPS offload on the iWave G51-AFibre-200G PCIe Accelerator Card. With P4 filtering disabled, the configured malicious traffic reached the host and triggered the Suricata alert. With P4 enabled, the FPGA applied the configured signature-matching rules to drop matching packets while forwarding non-matching TCP traffic; no corresponding Suricata alert was triggered during the reported test. The P4-enabled configuration recorded 1.0% CPU usage during NIPS offload
Conclusion
From data centres and cloud infrastructure to enterprise networks and cybersecurity appliances, iWave’s iW-Fibre SmartNIC enables infrastructure providers to integrate programmable, FPGA-based threat filtering into high-speed network processing. For organisations seeking to strengthen network security while reducing host CPU involvement in packet inspection, iWave offers a flexible hardware platform for building scalable, security-focused network solutions.
