Real-time Network Measurements Ran Ben Basat, Technion Joint work - - PowerPoint PPT Presentation

▶
real time network measurements
SMART_READER_LITE
LIVE PREVIEW

Real-time Network Measurements Ran Ben Basat, Technion Joint work - - PowerPoint PPT Presentation

Aug 15, 2023 321 likes •535 views

Real-time Network Measurements Ran Ben Basat, Technion Joint work with Gil Einziger, Erez Waisbard (Nokia Bell Labs) Roy Friedman (Technion) and Marcello Luzieli (UFGRS) ACC Annual Workshop & Feder Prize Ceremony Network Measurements ACC

slide-1
SLIDE 1

ACC Annual Workshop & Feder Prize Ceremony

Real-time Network Measurements

Ran Ben Basat, Technion

Joint work with Gil Einziger, Erez Waisbard (Nokia Bell Labs) Roy Friedman (Technion) and Marcello Luzieli (UFGRS)

slide-2
SLIDE 2

ACC Annual Workshop & Feder Prize Ceremony

Network Measurements

slide-3
SLIDE 3

ACC Annual Workshop & Feder Prize Ceremony

Network Measurements

Elephant Flows Detection

Load Balancing Traffic Engineering Caching

Counting Distinct Elements

DDoS Identification Worm Propagation Link-based SEO

Estimating the fraction of rare flows

Customer Satisfaction DDoS Detection

Computing Quantiles

Data Log Analysis Network Health Monitoring

Sliding Windows Statistics

Link Utilization Trend Detection

slide-4
SLIDE 4

ACC Annual Workshop & Feder Prize Ceremony

Heavy Hitters

How many packets has sent? Which flows are larger than 𝑈? Traditionally – must fit in the SRAM

7

Can’t allocate a counter for each flow!

Year 2012 2014 2016 SRAM (MB) 10-20 30-60 50-100

(SilkRoad, SIGCOMM 2017)

slide-5
SLIDE 5

ACC Annual Workshop & Feder Prize Ceremony

Distributed Denial of Service

slide-6
SLIDE 6

ACC Annual Workshop & Feder Prize Ceremony

Hierarchical Heavy Hitters (HHH)

LADS: Large-scale Automated DDoS Detection System.

USENIX ATC 2006

DREAM: dynamic resource allocation for software-defined Counting.

ACM SIGCOMM 2014

Automatically Inferring Patterns of Resource Consumption in Network Traffic.

ACM SIGCOMM 2003

Hierarchical Heavy Hitters identify traffic clusters.

They are at the core of numerous DDoS mitigation systems…

DDoS attack (Aug. 2014)

slide-7
SLIDE 7

ACC Annual Workshop & Feder Prize Ceremony

DDoS Mitigation

181.7.20.1 181.7.20.2 … 181.7.21.1 181.7.21.2 …

Can we block only the attacking devices?

slide-8
SLIDE 8

ACC Annual Workshop & Feder Prize Ceremony

Hierarchical Heavy Hitters

181.7.20.∗ 220.7.16.9 181.7.20.13 181.7.∗.∗ 220.7.16.∗

Hierarchical Heavy Hitters identifies frequent:

  • Flows (heavy hitters)
  • Source networks.
  • Source-Destination pairs.
slide-9
SLIDE 9

ACC Annual Workshop & Feder Prize Ceremony

State of the art

Compute all prefixes

Level0 Counting Level1 Counting Level2 Counting Level3 Counting Level4 Counting

1.7.20.6

181.7.20.6 181.7.20.* 181.7.*.* 181.*.*.* *.*.*.*

Level1 Counting Level0 Counting Level2 Counting Level3 Counting Level4 Counting

“Count each prefix independently.”

Mitzenmacher et al., Hierarchical Heavy Hitters with the Space Saving Algorithm, ALENEX 2012

slide-10
SLIDE 10

ACC Annual Workshop & Feder Prize Ceremony

Compute a random prefix

Level0 Counting Level1 Counting Level2 Counting Level3 Counting Level4 Counting

1.7.20.6

181.7.20.*

Level1 Counting

Randomized HHH (Our work)

“Select a prefix at random and count it”

slide-11
SLIDE 11

ACC Annual Workshop & Feder Prize Ceremony

Compute a random prefix

Level0 Counting Level1 Counting Level2 Counting Level3 Counting Level4 Counting

181.7.20.*

Level1 Counting

With probability 90%

Ignore packet

181.7.20.6 188.3.12.3 188.67.7.1 92.67.7.81 181.7.20.2 181.7.20.3

Additional Speedup

slide-12
SLIDE 12

ACC Annual Workshop & Feder Prize Ceremony

We did the math

Accuracy and convergence guarantees .

After enough packets there are:

  • 1. No false negatives.
  • 2. No counting errors.
  • 3. Only a few false positives.
slide-13
SLIDE 13

ACC Annual Workshop & Feder Prize Ceremony

How much traffic is needed for convergence?

One prefix packet One prefix per 10 packets 32M packets 32M packets 128M packets 128M packets “Accuracy improves with the number of packets”

False Negatives Counting Errors

slide-14
SLIDE 14

ACC Annual Workshop & Feder Prize Ceremony

Comparison with other HHH algorithms

One prefix per packet One prefix per 10 packets Mitzenmacher et al.

Cormode et al., Finding hierarchical heavy hitters in streaming data, TKDD 2008

“Accuracy improves with the number of packets”

slide-15
SLIDE 15

ACC Annual Workshop & Feder Prize Ceremony

Virtual Switching

VMK VM1 VM2 VM3 VM4

vSwitch

APP OS APP OS APP OS APP OS

Physical switch

Physical NIC Virtual NIC The new bottleneck: CPU DRAM is cheap 

slide-16
SLIDE 16

ACC Annual Workshop & Feder Prize Ceremony

Open vSwitch Implementation

Server A: Traffic Generator

– We send min-sized packets with headers from Internet traces.

Server B: DPDK enabled Open vSwitch

– Performs HHH Counting in data plane

Traffic Generator Open vSwitch

slide-17
SLIDE 17

ACC Annual Workshop & Feder Prize Ceremony

Comparing Implementation Overhead

Highlights:

Only -4% overheads for HHH in the OVS data plane! +250% throughput improvement compared to previous work.

Mitzenmacher et al. One prefix per packet One prefix per 10 packets OVS

slide-18
SLIDE 18

ACC Annual Workshop & Feder Prize Ceremony

  • w to detect the maximal-prefix networks?

Takeaways

  • Real time hierarchical heavy hitters

measurement in networking devices.

  • Provable accuracy guarantees.
  • Open source code:

https://github.com/ranbenbasat/RHHH

slide-19
SLIDE 19

ACC Annual Workshop & Feder Prize Ceremony

Limitations and current projects

Support for weights Support for sliding windows

– No convergence time!

Allowing time-based queries

– “What are the HHH for Jan 20th 2018, 4PM-5PM?”

slide-20
SLIDE 20

ACC Annual Workshop & Feder Prize Ceremony

Any Questions