cally or dynamically diverted, by match- action criteria, to different VNFs based on higher-level policy or input from an SDN controller. The matching criteria can look at layers 2-4, and also has the possibility to go up to layer 7 when integrating with a deep packet inspection (DPI) engine. However, test results show that virtual switch implementations (such as standard open virtual switch) are inferior, from a performance perspective, to simple bridging environment. The reason for this is increased packet processing (deeper analysis done on each packet) that not only impairs switching performance but also incurs more. Figures 10.9 and 10.10 provide the topology and performance results associated with OVS approach without and with DPDK. To increase the overall packet performance, a DPDK-enabled virtual switch was introduced instead of standard OVS [5]. In short, the DPDK-enabled virtual switch is a newer version of OVS that was enhanced by Intel to use DPDK libraries designed to accelerate packet processing on x.86 hardware. Additional details on DPDK are discussed in a later section of this chapter. OVS Bridge 10000 OVS BRIDGE KERNEL PKTGEN PKTGEN Frame Size (bytes) Throughput (Mbps) Throughput (kpps) FIGURE 10.9 Performance results with OVS. Enterprise Networks DPDK OVS 22000 16000 OVS DPDK 20000 14000 18000 16000 12000 USER SPACE 14000 10000 12000 10000 KERNEL Frame Size (bytes) PKTGEN PKTGEN Throughput (Mbps) Throughput (kpps) FIGURE 10.10 Performance results with OVS DPDK. The performance gains associated for packet matching and forwarding the packet through the virtual switch, are significant. As long as the VNF implements a virtual driver to make use of DPDK-enabled virtual switching, it could copy the packet directly from the pNIC to its own memory space (and vice versa, in the reverse direction). While the DPDK-enabled virtual switch approach provides the best of both worlds, that is, good performance and an excellent feature-set, it comes at a cost. The processing associated with its feature-set and d