Generic Packet Parsing — Architecture & Pipelines

Overview

Packet parsing is the process of extracting structured information from raw packet bytes so that subsequent stages—classification, QoS marking, scheduling, forwarding, and security checks—can operate on well‑defined fields. Parsing transforms a byte stream into a hierarchical representation of protocol headers, enabling hardware and software systems to understand packet structure, identify encapsulations, and apply the correct processing logic.

Modern parsers must support variable‑length headers, nested encapsulations, tunneling protocols, and programmable pipelines, all while maintaining high throughput and deterministic latency.

Parsing Objectives

Packet parsing is designed to achieve several key goals:

• Identify protocol headers and their boundaries
• Extract key fields for classification, routing, and QoS
• Handle variable‑length and optional headers
• Support encapsulation and tunneling (VLAN, MPLS, GRE, VXLAN, IP‑in‑IP)
• Provide deterministic latency in hardware pipelines
• Enable programmability in modern data planes (P4, eBPF, programmable switches)

Parsing is the first and most critical stage of packet processing.

Architectural Principles

Header Recognition

Parsers identify headers using:

• EtherType
• IP protocol field
• Next Header field (IPv6)
• MPLS label stack
• custom metadata in programmable pipelines

Correct header recognition is essential for accurate processing.

Offset Calculation

Parsers compute the offset of each header based on:

• fixed header lengths
• variable‑length fields (e.g., IPv4 options, TCP options)
• encapsulation depth
• alignment constraints

Offset calculation determines where the next header begins.

Field Extraction

Specific fields are extracted for downstream logic:

• MAC addresses
• VLAN tags
• IP addresses
• DSCP/ECN bits
• TCP/UDP ports
• MPLS labels
• tunnel identifiers

Extracted fields populate metadata structures used by the pipeline.

Parsing Graph

Modern parsers use a state machine or directed graph where each node represents a header and transitions depend on header values.

This enables flexible parsing of complex encapsulations.

Parsing Pipelines

Software Parsing Pipelines

Used in:

• OS network stacks
• virtual switches (OVS, VPP)
• user‑space networking (DPDK)

Characteristics:

• flexible and programmable
• higher latency than hardware
• optimized with SIMD, prefetching, and batching

Hardware Parsing Pipelines

Used in:

• NICs
• switches and routers
• high‑speed interconnects
• programmable ASICs

Characteristics:

• deterministic latency
• deep pipelining
• parallel extraction
• limited flexibility unless programmable

Programmable Parsing Pipelines

Enabled by languages like P4 and eBPF.

Characteristics:

• user‑defined header formats
• dynamic parsing graphs
• protocol‑agnostic hardware
• high performance with flexibility

Programmable parsing is becoming the standard in modern data planes.

Handling Variable‑Length Headers

IPv4 Options

IPv4 headers may include optional fields, requiring:

• dynamic offset calculation
• conditional parsing
• bounds checking

IPv6 Extension Headers

IPv6 uses a chain of extension headers:

• Hop‑by‑Hop
• Routing
• Fragment
• Destination Options

Parsers must follow the chain until the transport header is reached.

TCP Options

TCP options (MSS, timestamps, SACK) require:

• scanning variable‑length option lists
• alignment handling
• early termination on EOL option

Tunneling Protocols

Encapsulations like GRE, VXLAN, and GENEVE introduce:

• additional headers
• optional fields
• nested transport headers

Parsers must support deep and flexible encapsulation.

Encapsulation and Tunneling

VLAN and Q‑in‑Q

Multiple VLAN tags require stacked parsing.

MPLS

MPLS uses a label stack; parsers must:

• pop labels until Bottom‑of‑Stack (BoS)
• extract TC and TTL fields

GRE, IP‑in‑IP, VXLAN, GENEVE

Tunnels introduce:

• outer headers
• inner headers
• optional metadata

Parsers must recursively process encapsulated packets.

Parser Performance Considerations

Latency

Hardware parsers must provide deterministic, low latency.
Software parsers optimize latency using:

• batching
• prefetching
• zero‑copy techniques

Throughput

High‑speed links (100G/400G/800G) require:

• deep pipelining
• parallel extraction
• minimal branching

Memory Access

Parsing is memory‑intensive; optimizations include:

• aligned accesses
• fixed‑offset extraction when possible
• caching header templates

Flexibility vs Speed

Programmable parsers trade raw speed for flexibility.
ASIC parsers are faster but less adaptable.

Parser Design Patterns

Linear Parsing

Headers are parsed sequentially.

Pros: simple
Cons: inefficient for deep encapsulation

Graph‑Based Parsing

Uses a state machine with transitions based on header values.

Pros: flexible, supports complex protocols
Cons: requires more logic

Parallel Parsing

Extracts fields from multiple headers simultaneously.

Pros: high throughput
Cons: requires fixed header formats

Hybrid Parsing

Combines linear and parallel parsing for optimal performance.

Parsing in Modern Systems

Data Center Switches

Use programmable ASICs with:

• P4‑defined parsers
• deep pipelines
• support for VXLAN, GENEVE, MPLS

NICs

NICs parse:

• L2/L3/L4 headers
• tunnel headers
• RSS hash fields

Parsing feeds hardware offload engines.

Operating Systems

OS stacks parse packets for:

• routing
• firewall rules
• socket demultiplexing

Software parsing must balance flexibility and performance.

High‑Speed Interconnects

PCIe, CXL, and NoCs use fixed, deterministic parsing for flits and packets.

Comparison of Parsing Approaches

Approach	Flexibility	Latency	Throughput	Typical Use
Software	Very High	Medium	Medium	OS, virtual switches
ASIC	Low	Very Low	Very High	Routers, switches
Programmable ASIC	High	Low	High	Modern data planes
NIC Hardware	Medium	Very Low	High	Offload engines

Design Tradeoffs

• Flexibility vs performance — programmable parsers support new protocols but add latency.
• Depth vs complexity — deep encapsulation requires more states and memory.
• Determinism vs adaptability — ASICs are deterministic; software is adaptable.
• Power vs throughput — high‑speed parsing consumes significant power.
• Security vs performance — deep inspection increases overhead.

Related Pages

• Packet Classification & QoS Marking — Architecture & Mechanisms
• Packet Scheduling — Architecture & Algorithms
• Traffic Shaping & Policing — Architecture & Algorithms
• Queue Management & Congestion Control — Architecture & Algorithms
• Packet Fragmentation & Reassembly — Architecture & Design Considerations

Summary

Generic packet parsing transforms raw bytes into structured metadata by identifying headers, extracting fields, and navigating encapsulations. Through linear, graph‑based, or programmable pipelines, modern systems achieve the required balance of flexibility, performance, and determinism across software stacks, NICs, switches, and high‑speed interconnects.