47 research outputs found
Forwarding Tables Verification through Representative Header Sets
Forwarding table verification consists in checking the distributed
data-structure resulting from the forwarding tables of a network. A classical
concern is the detection of loops. We study this problem in the context of
software-defined networking (SDN) where forwarding rules can be arbitrary
bitmasks (generalizing prefix matching) and where tables are updated by a
centralized controller. Basic verification problems such as loop detection are
NP-hard and most previous work solves them with heuristics or SAT solvers. We
follow a different approach based on computing a representation of the header
classes, i.e. the sets of headers that match the same rules. This
representation consists in a collection of representative header sets, at least
one for each class, and can be computed centrally in time which is polynomial
in the number of classes. Classical verification tasks can then be trivially
solved by checking each representative header set. In general, the number of
header classes can increase exponentially with header length, but it remains
polynomial in the number of rules in the practical case where rules are
constituted with predefined fields where exact, prefix matching or range
matching is applied in each field (e.g., IP/MAC addresses, TCP/UDP ports). We
propose general techniques that work in polynomial time as long as the number
of classes of headers is polynomial and that do not make specific assumptions
about the structure of the sets associated to rules. The efficiency of our
method rely on the fact that the data-structure representing rules allows
efficient computation of intersection, cardinal and inclusion. Finally, we
propose an algorithm to maintain such representation in presence of updates
(i.e., rule insert/update/removal). We also provide a local distributed
algorithm for checking the absence of black-holes and a proof labeling scheme
for locally checking the absence of loops
Deux défis des Réseaux Logiciels : Relayage par le Nom et Vérification des Tables
The Internet changed the lives of network users: not only it affects users' habits, but it is also increasingly being shaped by network users' behavior.Several new services have been introduced during the past decades (i.e. file sharing, video streaming, cloud computing) to meet users' expectation.As a consequence, although the Internet infrastructure provides a good best-effort service to exchange information in a point-to-point fashion, this is not the principal need that todays users request. Current networks necessitate some major architectural changes in order to follow the upcoming requirements, but the experience of the past decades shows that bringing new features to the existing infrastructure may be slow.In this thesis work, we identify two main aspects of the Internet evolution: a âbehavioralâ aspect, which refers to a change occurred in the way users interact with the network, and a âstructuralâ aspect, related to the evolution problem from an architectural point of view.The behavioral perspective states that there is a mismatch between the usage of the network and the actual functions it provides. While network devices implement the simple primitives of sending and receiving generic packets, users are really interested in different primitives, such as retrieving or consuming content. The structural perspective suggests that the problem of the slow evolution of the Internet infrastructure lies in its architectural design, that has been shown to be hardly upgradeable.On the one hand, to encounter the new network usage, the research community proposed the Named-data networking paradigm (NDN), which brings the content-based functionalities to network devices.On the other hand Software-defined networking (SDN) can be adopted to simplify the architectural evolution and shorten the upgrade-time thanks to its centralized software control plane, at the cost of a higher network complexity that can easily introduce some bugs. SDN verification is a novel research direction aiming to check the consistency and safety of network configurations by providing formal or empirical validation.The talk consists of two parts. In the first part, we focus on the behavioral aspect by presenting the design and evaluation of âCaesarâ, a content router that advances the state-of-the-art by implementing content-based functionalities which may coexist with real network environments.In the second part, we target network misconfiguration diagnosis, and we present a framework for the analysis of the network topology and forwarding tables, which can be used to detect the presence of a loop at real-time and in real network environments.Cette thĂšse aborde des problĂšmes liĂ©s Ă deux aspects majeurs de lâĂ©volution dâInternet : lâaspect >, qui correspond aux nouvelles interactions entre les utilisateurs et le rĂ©seau, et lâaspect >, liĂ© aux changements dâInternet dâun point de vue architectural.Le manuscrit est composĂ© dâun chapitre introductif qui donne les grandes lignes de recherche de ce travail de thĂšse, suivi dâun chapitre consacrĂ© Ă la description de lâĂ©tat de lâart sur les deux aspects mentionnĂ©s ci-dessus. Parmi les solutions proposĂ©es par la communautĂ© scientifique pour s'adapter Ă lâĂ©volution dâInternet, deux nouveaux paradigmes rĂ©seaux sont particuliĂšrement dĂ©crits : Information- Centric Networking (ICN) et Software-Defined Networking (SDN).La thĂšse continue avec la proposition de >, un dispositif rĂ©seau, inspirĂ© par ICN, capable de gĂ©rer la distribution de contenus Ă partir de primitives de routage basĂ©es sur le nom des donnĂ©es et non les adresses des serveurs. Caesar est prĂ©sentĂ© dans deux chapitres, qui dĂ©crivent lâarchitecture et deux des principaux modules : le relayage et la gestion de la traçabilitĂ© des requĂȘtes.La suite du manuscrit dĂ©crit un outil mathĂ©matique pour la dĂ©tection efficace de boucles dans un rĂ©seau SDN dâun point de vue thĂ©orique. Les amĂ©liorations de lâalgorithme proposĂ© par rapport Ă lâĂ©tat de lâart sont discutĂ©es.La thĂšse se conclue par un rĂ©sumĂ© des principaux rĂ©sultats obtenus et une prĂ©sentation des travaux en cours et futurs
Inference of virtual network functions' state via analysis of the CPU behavior
The on-going process of softwarization of IT networks
promises to reduce the operational and management costs of
network infrastructures by replacing hardware middleboxes with
equivalent pieces of code executed on general-purpose servers.
Alongside the benefits from the operatorâs perspective, new
strategies to provide the networkâs resources to users are arising.
Following the principle of âeverything as a serviceâ, multiple
tenants can access the required resources â typically CPUs, NICs,
or RAM â according to a Service-Level Agreement. However,
tenantsâ applications may require a complex and expensive
measurement infrastructure to continuously monitor the network
functionâs state. Although the applicationâs specific behavior is
unknown (and often opaque to the infrastructure owner), the
software nature of (virtual) network functions (VNFs) may be
the key to infer the behavior of the high-level functions by
accessing low-level information, which is still under the control of
the operating system and therefore of the infrastructure owner.
As such, in the scenario of software VNFs executed on COTS
servers, the underlying CPUâs behavior can be used as the sole
predictor for the high-level VNF state without explicit in-network
measurements: in this paper, we develop a novel methodology
to infer high-level characteristics such as throughput or packet
loss using CPU data instead of network measurements. Our
methodology consists of (i) experimentally analyzing the behavior
of a CPU that executes a VNF under different loads, (ii)
extracting a correlation between the CPU footprint and the highlevel application state, and (iii) use this knowledge to detect the
previously mentioned network metrics. Our code and datasets
are publicly available
Performance Benchmarking of State-of-the-Art Software Switches for NFV
With the ultimate goal of replacing proprietary hardware appliances with
Virtual Network Functions (VNFs) implemented in software, Network Function
Virtualization (NFV) has been gaining popularity in the past few years.
Software switches route traffic between VNFs and physical Network Interface
Cards (NICs). It is of paramount importance to compare the performance of
different switch designs and architectures. In this paper, we propose a
methodology to compare fairly and comprehensively the performance of software
switches. We first explore the design spaces of seven state-of-the-art software
switches and then compare their performance under four representative test
scenarios. Each scenario corresponds to a specific case of routing NFV traffic
between NICs and/or VNFs. In our experiments, we evaluate the throughput and
latency between VNFs in two of the most popular virtualization environments,
namely virtual machines (VMs) and containers. Our experimental results show
that no single software switch prevails in all scenarios. It is, therefore,
crucial to choose the most suitable solution for the given use case. At the
same time, the presented results and analysis provide a deeper insight into the
design tradeoffs and identifies potential performance bottlenecks that could
inspire new designs.Comment: 17 page
NFV Platforms: Taxonomy, Design Choices and Future Challenges
Due to the intrinsically inefficient service provisioning in traditional networks, Network Function Virtualization (NFV) keeps gaining attention from both industry and academia. By replacing the purpose-built, expensive, proprietary network equipment with software network functions consolidated on commodity hardware, NFV envisions a shift towards a more agile and open service provisioning paradigm. During the last few years, a large number of NFV platforms have been implemented in production environments that typically face critical challenges, including the development, deployment, and management of Virtual Network Functions (VNFs). Nonetheless, just like any complex system, such platforms commonly consist of abounding software and hardware components and usually incorporate disparate design choices based on distinct motivations or use cases. This broad collection of convoluted alternatives makes it extremely arduous for network operators to make proper choices. Although numerous efforts have been devoted to investigating different aspects of NFV, none of them specifically focused on NFV platforms or attempted to explore their design space. In this paper, we present a comprehensive survey on the NFV platform design. Our study solely targets existing NFV platform implementations. We begin with a top-down architectural view of the standard reference NFV platform and present our taxonomy of existing NFV platforms based on what features they provide in terms of a typical network function life cycle. Then we thoroughly explore the design space and elaborate on the implementation choices each platform opts for. We also envision future challenges for NFV platform design in the incoming 5G era. We believe that our study gives a detailed guideline for network operators or service providers to choose the most appropriate NFV platform based on their respective requirements. Our work also provides guidelines for implementing new NFV platforms
On the Learnability of Software Router Performance via CPU Measurements
In the last decade the ICT community observed a growing popularity of software networking paradigms. This trend consists in moving network applications from static, expensive, hardware equipment (e.g. router, switches, firewalls) towards flexible, cheap pieces of software that are executed on a commodity server. In this context, a server owner may provide the server resources (CPUs, NICs, RAM) for customers, following a Service-Level Agreement (SLA) about clients' requirements. The problem of resource allocation is typically solved by overprovisioning, as the clients' application is opaque to the server owner, and the resource required by clients' applications are often unclear or very difficult to quantify. This paper shows a novel approach that exploits machine learning techniques in order to infer the input traffic load (i.e., the expected network traffic condition) by solely looking at the runtime CPU footprint
Efficient Loop Detection in Forwarding Networks and Representing Atoms in a Field of Sets
The problem of detecting loops in a forwarding network is known to be
NP-complete when general rules such as wildcard expressions are used. Yet,
network analyzer tools such as Netplumber (Kazemian et al., NSDI'13) or
Veriflow (Khurshid et al., NSDI'13) efficiently solve this problem in networks
with thousands of forwarding rules. In this paper, we complement such
experimental validation of practical heuristics with the first provably
efficient algorithm in the context of general rules. Our main tool is a
canonical representation of the atoms (i.e. the minimal non-empty sets) of the
field of sets generated by a collection of sets. This tool is particularly
suited when the intersection of two sets can be efficiently computed and
represented. In the case of forwarding networks, each forwarding rule is
associated with the set of packet headers it matches. The atoms then correspond
to classes of headers with same behavior in the network. We propose an
algorithm for atom computation and provide the first polynomial time algorithm
for loop detection in terms of number of classes (which can be exponential in
general). This contrasts with previous methods that can be exponential, even in
simple cases with linear number of classes. Second, we introduce a notion of
network dimension captured by the overlapping degree of forwarding rules. The
values of this measure appear to be very low in practice and constant
overlapping degree ensures polynomial number of header classes. Forwarding loop
detection is thus polynomial in forwarding networks with constant overlapping
degree
Performance comparison between the Click Modular Router and the NetFPGA
It is possible to forward minimum-sized packets at rates of hundreds of Mbps using commodity hardware and Linux. We had a preference for the Click Modular Router platform due its flexibility and the fact that it claimed to have equal or higher performance than native forwarding if used with its polling drivers. Moreover, the NetFPGA is an open networking platform accelerator that enables researchers and instructors to build working prototypes of high-speed, hardware-accelerated networking systems. NetFPGA reference designs comprised in the system include an IPv4 router, an Ethernet switch, a four-port NIC, and SCONE (Software Component of NetFPGA). Researchers have used the platform to build advanced network flow processing systems. We have followed the RFC1242 - Benchmarking Terminology for Network Interconnection Devices - and the RFC2544 - Benchmarking Methodology for Network Interconnection Devices - in order to define the specific set of tests to use to describe the performance characteristics of the two routers. We have also shown a test comparison between the NetFPGA and the Click router about a file transfer using the FTP and the HTTP protocol.Overall, the NetFPGA router performance outperforms the Click router performance
FloWatcher-DPDK: lightweight line-rate flow-level monitoring in software
In the last few years, several software-based solutions have been proved to be very efficient for high-speed packet processing, traffic generation and monitoring, and can be considered valid alternatives to expensive and non-flexible hardware-based solutions. In our work, we first benchmark heterogeneous design choices for software-based packet monitoring systems in terms of achievable performance and required resources (i.e., the number of CPU cores). Building on this extensive analysis we design FloWatcher-DPDK, a DPDK-based high-speed software traffic monitor we provide to the community as an open source project. In a nutshell, FloWatcher-DPDK provides tunable fine-grained statistics at packet and flow levels. Experimental results demonstrate that FloWatcher-DPDK sustains per-flow statistics with 5-nines precision at high-speed (e.g., 14.88 Mpps) using a limited amount of resources. Finally, we showcase the usage of FloWatcher-DPDK by configuring it to analyze the performance of two open source prototypes for stateful flow-level end-host and in-network packet processing