State Machine Abstraction for Dynamic Network Actions in SDN
State machines are proposed as a new switch primitive in Software-Defined Networking (SDN) to facilitate dynamic actions at switches. This approach eliminates the need for a priori knowledge, reduces delays, and enables local state-based policies such as stateful firewall, FTP monitoring, and large source IP detection. The Flow-level State Transition as a New Switch Primitive (HotSDN'14) called FAST (Flow-level State Transitions) abstracts control and data planes to efficiently program state transitions and actions at switches. Evaluation in Open vSwitch demonstrates significant performance improvements with minimal overhead.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Flow-level State Transition as a New Switch Primitive for SDN (HotSDN 14) Masoud Moshref, Apoorv Bhargava, Adhip Gupta, Minlan Yu, Ramesh Govindan
Motivation 2 Current practice Proactive needs a priori knowledge Reactive has high delay Opportunity: Local state is enough for many policies (stateful firewall, FTP monitoring, large source IP detection) Key idea: State machine is a general but efficient abstraction to allow dynamic actions at switches
FAST (Flow-level State Transitions) Abstraction 3 Controller proactively programs state transitions and actions at switches Switches run state machines and actions of a state Examples: Stateful firewall: TCP state machine with actions that drop uninitiated flows FTP Monitoring: Track the states of control channel & allow data channel traffic Large source IP detection: Keep a counter per IP and compare it against a threshold
FAST Control Plane 4 Controller translates state machines to switch API Close 1 SYN ACK FINACK None Init2 Close 2 Init1 Est FIN SYNACK controller FAST compiler FAST Switch agent Switch agent Network
FAST Data Plane 5 FAST data plane is implementable in hardware switch components Packet State table State machine filter Index State Packet, H(p) Match State machine index Packet 0 Est Close1 Pick fields and hash 1100** 0 (UDP) 1 Init2 100*** 1 (TCP) 2 Est Update state Packet, Est Action table State transition table Match State Match State Action Next state 20.1/16 None Drop Fin Est Close1 Packet, Close1 10.1/16 * Port1 * Est Est Packet
FAST Data Plane Evaluation in Open vSwitch 6 Delay of going through all TCP states for FAST is small 1 packet, 1 flow : FAST: 28x faster (3ms) > 64 concurrent flows: 6ms FAST state lookup has small overhead: Iperf throughput (Gbps): <5% overhead
