Policing offloaded

Policing of incoming packets can produce very high load in worst-case situations on a receiving computer. In real time systems, resources must be allocated for such worst-case situations if guarantees are given to processes. The paper describes design and implementation of a policing function on an off-the-shelf network adapter board containing a relatively slow microprocessor. Performance measurements indicate that the host computer can be effectively shielded from misbehaving inbound connections. The load on the host CPU is confined to be proportional to the number of packets on admitted and conforming connections, even in the presence of very large numbers of incoming packets on not-admitted connections. As a side effect, zero-copy implementation of protocols is supported.