ClickOS and the Art of Network Function Virtualization
📜 Abstract
Over the years middleboxes have become a fundamental part of today’s networks. Despite their usefulness, they come with a number of problems, many of which arise from the fact that they are hardware-based: they are costly, difficult to manage, and their functionality is hard or impossible to change, to name a few. To address these issues, there is a recent trend towards network function virtualization (NFV), in essence proposing to turn these middleboxes into software-based, virtualized entities. Towards this goal we introduce ClickOS, a high-performance, virtualized software middlebox platform. ClickOS virtual machines are small (5MB), boot quickly (about 30 milliseconds), add little delay (45 microseconds) and over one hundred of them can be concurrently run while saturating a 10Gb pipe on a commodity server. We further implement a wide range of middleboxes including a firewall, a carrier-grade NAT and a load balancer and show that ClickOS can handle packets in the millions per second.
✨ Summary
Summary
The paper introduces ClickOS, a Xen-based NFV platform that combines a minimal MiniOS guest with the Click modular router. Its central design contribution is a specialized high-speed network I/O path: the platform replaces Open vSwitch with an optimized VALE-based switch, moves most netback processing into the control plane, reuses Xen memory grants, and directly maps packet-buffer rings into guest memory. This reduces packet copies, hypercalls, virtual-interface overhead, and other costs in the conventional Xen networking path.
The evaluation reports 5 MB VM images, approximately 30 ms startup time, approximately 45 μs idle packet-processing delay, support for hundreds of concurrently instantiated VMs, and millions of packets per second for several middlebox types. On the tested commodity hardware, ClickOS reaches near line rate for many packet sizes and workloads, although performance declines for minimum-sized packets, long middlebox chains, and configurations constrained by limited CPU parallelism. The system supports reusable Click elements for functions including routing, firewalls, NAT, load balancing, traffic shaping, monitoring, tunneling, and intrusion detection.
Subsequent research used ClickOS as a reference NFV dataplane and as an experimental platform. A later study on ClickOS-based NFV management examined management requirements such as function requests and lifecycle control. (dl.ifip.org) A 2016 measurement study directly compared ClickOS with SoftNIC, validated many of the original performance results, and identified limitations involving small packets, NF chaining, NUMA placement, NIC queues, and the lack of SMP support. (arxiv.org) Later NFV surveys describe ClickOS as an influential lightweight VNF platform and preserve its optimized Xen/VALE/netmap architecture as a representative approach to high-performance virtualized packet processing. (mdpi.com) The search found clear evidence of continued research use and benchmarking, but no independently verified evidence in the cited sources of a specific production-industry deployment directly attributable to this paper.