The rise of remote work highlights cybersecurity and ethics issues, making organizations adopt numerous tools to keep businesses safe from hackers, malware, and leaks. Given the scale of damage caused by all sorts of troubles that may occur in or via corporate networks, looking for a potential attack is a paramount task, just as making sure that the performance of apps, services, and employees is up to appropriate business standards.

Packet capture me if you can

Packet analyzing is among the most efficient ways to detect threats and check the overall network condition. The objectives are achieved with the help of packet capture devices enabled to ‘extract’ the traffic coming to or from any given address and check anything about it, from a history of requests to the time of reaction of apps and services. Packets of traffic can be captured, recorded, indexed at the administrator’s request or periodically – or an organization may opt for continuous stream capturing, depending on how crucial it is for a business to analyze it. After the data is captured, and if problems are detected, an organization may proceed with urgent steps to handle them and use the captured information in the future for deeper analysis.

Sounds optimistic and straightforward. But there must be some challenge, right?

Yes. The more data you need to analyze, the more performance is demanded from the packet storage devices, which is hugely impacted by the types of drives used and their restrictions. One of the most significant issues in this field is writing sequential data directly to storage with consistent performance. Data capture devices must record data directly at more than 12 GB/s to prevent packet loss when using 100 Gb/s networks, which sounds too much of a task, as most SSDs are optimized for random rather than sequential workloads.

Only NVMe-based solutions can handle such workloads. Unfortunately, due to the prevailing opinion that it is impossible to create an effective fault-tolerant RAID on NVMe in most cases, reliability is sacrificed for performance. Most continue to use non-NVMe hardware and software in RAID 0 configuration (losing reliability) or RAID 10 (losing cost-effectiveness).

It’s a new ERA for NVMe

There’s no need for such a sacrifice, though, as a specialized RAID software solution comes into play. When developed to realize a specific protocol’s potential (NVMe in this case), the software can overcome reliability issues and performance bottlenecks that NVMe-based systems are prone to.

RAIDIX ERA embodies a perfect solution for packet capture appliances. Its software RAID is presented by a Linux kernel module and management utility, making it highly compatible. ERA features include innovative RAID technologies based on proprietary algorithms that provide stable and fast performance. With I/O handling parallelization and lockless datapath, ERA maximizes NVMe capabilities, squeezing up to 97% of their possible performance, keeping CPU and RAM usage at a low 10-20%. 

Developed with NVMe architecture in mind and dealing great with sequential operations, RAIDIX ERA is way more efficient. It shows better performance than other RAID solutions such as Intel vROC, hardware controllers, and software RAIDs.

It’s worth saying a few words about RAIDIX itself. The company has been developing software-defined storage solutions for data-intensive tasks since 2009. What makes RAIDIX products different from others are proprietary RAID technologies programmed specifically for enterprise storage environments. Their prowess has been proved by successful uses cases, such as implementing software RAID solutions for autonomous vehicles or nearly doubling the performance of kdb+ databases.

What tests say

As mentioned above, for many RAID 0 or RAID 10 are configurations of choice. Sadly, the former brings high speed alongside sheer reliability fears, while the latter provides performance with bills to pay for the extra hardware. Being able to challenge the write speeds of the riskier or more expensive RAID levels in RAID 5 configuration gives RAIDIX ERA an upper hand — but this certainly needs to be proved.

One example is RAIDIX solution for data logging in autonomous vehicles. The task of recording all the data from every car’s sensor is way too challenging for the absolute majority of server platforms and RAID solutions. Why? Because the write performance has to be extremely high, while the size of the server platform is preferred to be as small as possible. These two criteria left no room for any drives but the brand new SSDs. But even with such top-notch equipment it had remained tricky. Not long ago a full-scale data-logging solution with just 12-16 SSD or NVMe drives was hard to come by, given the needs of data processing and PCIe limitations back in the early and mid-2010s. But since PCIe 4.0 introduction in 2019, things have changed. Nice and small server platforms became suitable for data-logging purposes in terms of performance, and their compact size was exactly what the manufacturers of autonomous vehicles and specialized solutions were looking for.

So this type of PCIe 4.0-based solution was chosen, with RAIDIX aboard, for specialized data-logging server platform tests by StorageReview. The storage system, powered by ERA engine, equipped with NVMe drives and configured as RAID 5 demonstrated sequential read transfer speeds as high as the similar system with no redundancy (in RAID 0 configuration). Also, despite redundancy, it delivered two-thirds of RAID 0’s sequential write speed — which is a powerful result for a cost-effective and fault-tolerant RAID 5.

Autonomous vehicles may present a kind of top-level task, but if you’re not dealing with these and need a performance boost, just add a few SSDs, and PCIe 3.0 will still do the job. But with RAIDIX ERA it will be an excellent type of job, and a few will not be a handy euphemism for dozens. Below we have another case of RAIDIX ERA being way more efficient with NVMe drives in RAID 5 configuration than MDADM, a standard RAID management tool by Linux.

System configuration (information disclosed):

CPU: Intel(R) Xeon(R) Gold
Motherboard: Supermicro
Sequential block size: 128k

8 WD SN640 NVMe SSD in RAID5 for both RAIDIX and MDADM

MDADM is completely outclassed and doesn’t seem to be a viable solution for NVMe storage at all, be it data logging, packet analyzing, or any other performance-demanding task.

Another benchmark addressed the old guard approach. Why not go with a hardware controller? It has always brought great performance, they say. Well — as we can see below — the performance gap is in ERA’s favor.

System configuration (information disclosed):

CPU: AMD EPYC 7702P

OS: Oracle Linux 8.3
8 WD SN640 NVMe SSD in RAID5 for RAIDIX, MDADM, and MegaRAID

Kernel: UEKR6 (5.4.17-2036.101.2.el8uek.x86_64)

How come that software RAID nearly triples the hardware RAID’s performance on writes — and almost reaches the baseline numbers, with one drive left for parity compared to all-drives baseline mode?

It goes down to ERA’s core design principles, which eliminate the bottleneck of architectural limitations that PCIe switches put on overall performance due to lane oversubscription. That increases costs, adds another hardware layer between the CPU and drives, and imposes performance limitations.

There’s no such bottleneck when there’re no PCIe switches needed at all, as it happens in software-defined storage.

To bring both simplicity and high performance, RAIDIX had developed and stuck to their unique data path approach that takes full advantage of NVMe and PCIe throughput, to NVMe enthusiasts’ great joy — finally, their drives will make a substantial difference. Add to this flexibility, zero hardware costs, and all-vendor compatibility of the ERA software. Also, it’s worth noticing that software RAID is now the only solution to support NVMe-oF JBOF devices for disaggregated storage. MDADM, again, performed poorly compared to RAIDIX ERA.

Finally, RAIDIX conducted ERA tests in its laboratory to determine if the system could stay within or above 12-13GB/s in RAID 50 10-drives NVMe configuration for packet capture devices purposes. It was shown clearly that those numbers are achievable:

System configuration (information disclosed):

CPU: Intel(R) Xeon(R) Gold
Motherboard: Supermicro
SmartNIC Napatech
File System: XFS
Sequential block size: 128k
Number of streams: 64
Queue depth: 32
RAID level: 50
Micron 9300 MAX NVMe SSDs

As the interface tells, RAIDIX experts were willing to emulate a real-life functioning of packet capture apps using the fio tool — flexible I/O tester — and the Netkeeper utility for testing.

Conclusion

As a solution for packet capture devices, RAIDIX ERA allows building a network analysis infrastructure without balancing between performance and reliability. This is made possible by using a fault-tolerant RAID 5, which ERA practically equals to RAID 10 or even RAID 0 in terms of performance, and keeps it as economical as RAID 5 is supposed to be. This, ironically, may bring a couple of new worries — about the speed of archiving all that data to external systems or about the resilience of those archives. These are worries that seem to be much more enjoyable, though.

The Western Digital Ultrastar® DC SN640 NVMe SSD is a mainstream NVMe^TM SSD targeting broad deployment as boot, caching, or primary storage in data center IT and cloud environments. It is a popular and efficient storage solution for enterprise-scale tasks that require consistent quality of service and low latency for mixed random read/write workloads commonly generated by applications such as virtualization, OLTP, NoSQL, web servers, file servers, and mail servers.

However, when a fault-tolerant solution is needed, traditional RAIDs on NVMe are unable to deliver full drive performance levels, which can be a problem for data-driven businesses.

The solution is to combine the Ultrastar DC SN640 SSDs with RAIDIX ERA software. Purpose-built for NVMe, with lockless datapath and I/O parallelization, RAIDIX ERA creates a highly performant software RAID from NVMe drives, putting out up to 97% of their raw performance. 

Testing performance

This impressive boost was seen during benchmarking tests performed by Western Digital engineers. When using 8 NVMe drives, 3,890,000 IOps for random read performance (RAID 5, 4k block), 454,000 IOps for random write performance (RAID 5, 4k block), and 1,260,000 IOps for random mixed performance (RAID 5, 4k block, 70/20 r/w) were reached.

These numbers are a big step up from the performance of traditional RAIDs. The tests also proved that RAIDIX ERA increases sequential read performance (RAID 5, 128k block), allowing it to reach 18.5 GB/s and boosts sequential write performance up to 11.5 GB/s.

Additional testing was also carried out to push the limits and see how RAIDIX ERA would perform in combination with RAID 5 volume consisting of twenty Ultrastar DC SN640 drives. During this testing, figures of 1,250,000 IOPS on random write performance were obtained, while random read performance reached 10,200,000 steady-state IOPS.

The Ultrastar DC SN640 NVMe drives also demonstrated their reliability as they were subjected to heavy workloads, sometimes exceeding ten full drive writes per day, over the course of several weeks, demonstrating stable performance with good thermal results. 

Testing parameters

It should be noted that while there is no single industry-accepted methodology for measuring the performance of multiple SSDs in a RAID configuration, Western Digital engineers chose to follow SNIA PTS, which is a standard for single-drive performance evaluation. 

In addition to the tests outlined above, RAIDIX’s own tests showed that ERA reduces latency to the limit of 0.5 ms. Even in degraded mode, performance remains high: for RAID 50, the penalty does not exceed 25%. Other RAIDIX ERA features are a wide range of supported RAID levels (RAID 0, 1, 5, 6, 7.3, 10, 50, 60, 70), POSIX API support, and surely being lightweight, as it only uses less than 20% CPU under the maximum array load, and no more than 4GB RAM is needed for full-featured work.

Such performance boosts overall efficiency and slashes business costs: for example, RAID 5 performance with 8 NVMe under RAIDIX ERA is comparable with RAID 10 performance with 16 NVMe drives.

To get a FREE RAIDIX ERA license for Western Digital Ultrastar SN640 drives, visit the RAIDIX website. The EU holders of the ERA license will also get access to an offer from Exertis Hammer with special prices for Western Digital Ultrastar SN640 SSDs and server platforms powered by Intel and AMD.