Direct Feature Access -- Scaling Network Traffic Feature Collection to Terabit Speed

TL;DR

This paper presents Direct Feature Access (DFA), a high-speed telemetry system that enables real-time, scalable network traffic feature collection at terabit speeds by leveraging programmable data planes and GPU direct delivery.

Contribution

DFA introduces a novel system that bypasses traditional bottlenecks, allowing direct, line-rate feature extraction and delivery to GPUs for immediate analysis at terabit speeds.

Findings

Achieved over 31 million feature vectors per second

Supported 524,000 flows within sub-20 ms monitoring periods

Implemented on Intel Tofino switches and NVIDIA A100 GPUs

Abstract

Real-time traffic monitoring is critical for network operators to ensure performance, security, and visibility, especially as encryption becomes the norm. AI and ML have emerged as powerful tools to create deeper insights from network traffic, but collecting the fine-grained features needed at terabit speeds remains a major bottleneck. We introduce Direct Feature Access (DFA): a high-speed telemetry system that extracts flow features at line rate using P4-programmable data planes, and delivers them directly to GPUs via RDMA and GPUDirect, completely bypassing the ML server's CPU. DFA enables feature enrichment and immediate inference on GPUs, eliminating traditional control plane bottlenecks and dramatically reducing latency. We implement DFA on Intel Tofino switches and NVIDIA A100 GPUs, achieving extraction and delivery of over 31 million feature vectors per second, supporting 524,000 flows within sub-20 ms monitoring periods, on a single port. DFA unlocks scalable, real-time, ML-driven traffic analysis at terabit speeds, pushing the frontier of what is possible for next-generation network monitoring.