the egress path of the example, the second IXP2800 handles flexible traffic shaping, Differentiated Services (DiffServ) for IP traffic, traffic management such as TM 4.1 for ATM networks, or custom traffic shaping. Regarding systems design and connection with coprocessors from other vendors, such as IPsec security coprocessor chips in a virtual private network (VPN) system, Intel recommends the use of either the SRAM interface bus or the IX bus to attach an IPsec coprocessor that will offload the net- work processor. In the case of the former, it can be done directly, if the IPsec coprocessor is compat- ible with the bus signals. In the worst-case scenario, it can also be done through using glue logic that must be implemented in an FPGA. In the case of the IX bus attachment, an IX bus bridge is required to interface the security coprocessor bus signals with the IX bus itself. If two network processors are available for the ingress and egress paths, the traffic load should be considered SO important that poten- tially two IPsec coprocessors must be used to support the computational load of calculating in real time and creating or stripping IPsec-encapsulated packets while still providing headroom to the NPUs for other fundamental networking packet processing. We will discuss these issues in more detail in Chapter 17, "Security Coprocessors." Another issue to keep in mind is that the SMP-based architecture, which offers a potential paral- lelism and software-based pipelining (as microengine threads can be cascaded essentially in any desired chained-link configuration), is essentially an environment that is more difficult to program than other NPUs that offer a single run time image environment. The high quality of the software development tools and, more specifically, of application software profiling tools and application par- titioning and fine-tuning tools, that Intel and its partners offer becomes a very critical consideration in such a context. Intel's vast relationships with third-party developers seem to aff