Overhead of the Kernel Mechanisms

**${\tablename}$ 5:** Performance of AFPA and matching a URL to a rule for a 8 KB file with different URL lengths.
Throughput (conn/sec)
URL	AFPA	AFPA on,	AFPA on,
off	(no cache)	(no cache)
length		no rule	matching rule
11 char.	370.1	340.5	338.3
80 char.	361.5	321.9	319.4
160 char.	355.1	321.1	303.7

**${\tablename}$ 6:** Overhead of kernel mechanisms
Operation		Cost( $\mu$ sec)
TCP SYN policing	1 filter rule	7.9
	3 filter rules	9.6
classification and priority	1 rule	4.4
	3 rules	5.0
AFPA including URL parsing		19
	1 rule	5.0
URL-based rate control	2 rules	5.8
including URL matching	3 rules	6.5
	1 rule	3.8
URL-based priority	2 rules	4.1
including URL matching	3 rules	4.3

We quantify the overhead of matching URLs in the kernel for varying URL lengths. Table 5 shows that the overhead of matching a URL to a rule is moderate (under 6% for a 160 character URL). The throughput numbers are for 20 Webstone clients requesting an 8 KB file. Rules are matched using the standard string comparison ( ${\ttfamily strcmp}$ ) with no optimizations; better matching techniques can reduce this overhead significantly. On a cache miss, the in-kernel AFPA cache introduces an overhead of about 10% for an 8 KB file. However, the AFPA cache under normal conditions increases performance significantly for cache hits. In our experiments we have the cache size set to 0 so that AFPA cannot serve any object from the cache. When caching is enabled Webstone received a throughput of over 800 connections per second on a cache hit.

Table 6 summarizes the additional overhead of the implemented kernel mechanisms. The overhead of compliance check and filter matching for TCP SYN policing with 1 filter rule is 7.9 $\mu$ secs. Simply matching the filter, allocating space to store QoS state, and setting the priority adds an overhead of around 4.4 $\mu$ secs for 1 filter rule. The policing controls are more expensive as they include accessing the clock for the current time. Surprisingly, the URL matching and rate control has a low overhead of 5.0 $\mu$ secs for a URL of 11 chars. This happens to be lower than SYN policing as the ${\ttfamily strcmp}$ matching is cheaper for one short URL compared to matching multiple IP addresses and port numbers. The overhead of URL matching and setting priorities for a single rule is around 3.8 $\mu$ secs. The most expensive operation is the call to AFPA to parse the URL. AFPA not only parses the URL, but also does logging, checks if the requested object is in the network buffer cache, and pre-computes the HTTP response header.