New device sizing - small packets and how it affects dataplane

[ylekiot1]

All,

I have a set of PA-5060 devices that are having issue with 300-400MB of throughput since my environment applications have packet payloads under the hard set min limits (48k) and forcing much of this to go to software for processing.  VERIFY your packet size distribution (payload) in your networks before you make that purchase.  I have 100% dataplane with 300-400MB of traffic.  

Symptom
High dataplane CPU caused due to abnormal increase in  "too small" or "too large" packets for content inspection.
The below global counters seem to increase with a corresponding rise in DP CPU usage:
aho_sw_min_threshold
aho_sw_max_threshold
dfa_sw_min_threshold
dfa_sw_max_threshold

Environment
Palo Alto Networks firewall with App-ID and Content Inspection

Cause
On platforms that have the content matching FPGA, the AHO and DFA content inspection algorithms are offloaded by default. There is a Minimum and Maximum threshold set for packets to be sent by dataplane to the FPGA for inspections.

If the packet size falls outside of Minimum and Maximum thresholds, these packets are processed in the dataplane, which result in increased dataplane utilization.

ho offload setup
        Use offload
        Minimum Threshold for using offload: 32 bytes
        Maximum Threshold for using offload: 9900 bytes

dfa offload setup
        Use offload
        Minimum Threshold for using offload: 48 bytes
        Maximum Threshold for using offload: 9900 bytes