Classic Network Measurements meets Software Defined Networking

Transcription

1 Classic Network s meets Software Defined Networking Ran Ben Basat, Technion, Israel Joint work with Gil Einziger and Erez Waisbard (Nokia Bell Labs) Roy Friedman (Technion) and Marcello Luzieli (UFGRS) 1

2 Network s

3 Network s Elephant Flows Detection Averaging over Sliding Load Balancing Windows Traffic Engineering Link Utilization Caching Trend Detection Counting Distinct Elements DDoS Identification Worm Propagation Link-based SEO Estimating the fraction of rare flows Customer Satisfaction DDoS Detection Computing Quantiles Data Log Analysis Network Health Monitoring 3

4 Frequency Estimation How many packets has sent? Classic Setting: Can t allocate a counter for each flow! In software: Memory is cheap (to an extent) Speed is the new bottleneck 4

5 Agenda Classical Frequency Estimation Algorithms. Accelerating space-oriented algorithms. Hierarchical Heavy Hitters. 5

6 Count Min Sketch (Cormode and Muthukrishnan) 2 ε counters log δ 1 Rows E Noise Nε/2 Pr Noise > Nε 1/2 Query( )= 2 Overall Pr Noise > Nε δ 6

7 Space Saving (Metwally et al.) For a N-sized stream, when allocated with m counters, Space Saving guarantees: Query( ) returns 3 Query ( ) returns 2 f x Query x f x + N m For achieving an Nε approximation, 1/ε counters are needed. ID Value

8 Agenda Classical Frequency Estimation Algorithms. Accelerating space-oriented algorithms. Hierarchical Heavy Hitters. 8

9 Accelerating s Algorithms Add x, w V V + w With probability τ(w/v) Otherwise Add x with weight w τ 1 (w/v) Ignore packet algorithm Start with a N sized stream and a (ε, δ) measurement algorithm. We can iteratively accelerate ourselves! Accelerated Algorithm Get an O(logN ε 2 logδ) sized stream and a (2ε, 3δ) measurement algorithm. 9

10 Empirical Evaluation 10

11 Empirical Evaluation 11

12 Distributed SDN Implementation 12

13 Agenda Classical Frequency Estimation Algorithms. Accelerating space-oriented algorithms. Hierarchical Heavy Hitters. 13

14 Hierarchical Heavy Hitters Can we block only the attacking devices? 14

15 Multi-Dimensional Hierarchies

16 Hierarchical Heavy Hitters using Space Saving (Mitzenmacher et al.) Level0 Level1 Compute all prefixes *.*.*.* 181.*.*.* *.* * Level2 Level3 Level4 16

17 Constant Time Hierarchical Heavy Hitters (SIGCOMM2017) Level0 Level1 Compute a random prefix * Level2 Level3 Level4 17

18 Constant Time Hierarchical Heavy Hitters (SIGCOMM2017) Level0 Level With probability 9/10 Compute a random prefix * Level2 Level3 Ignore packet Level4 18

19 Constant Time Hierarchical Heavy Hitters (SIGCOMM2017) How to detect the minimal prefix networks? How long it takes to converge? 19

20 Constant Time Hierarchical Heavy Hitters (SIGCOMM2017) 20

21 Constant Time Hierarchical Heavy Hitters (SIGCOMM2017) 21

22 Constant Time Hierarchical Heavy Hitters (SIGCOMM2017) 22

23 Any Questions 23