OpenNF: Enabling Network Function Control

 
Aaron Gember-Jacobson
, Chaithan Prakash,
Raajay Viswanathan, Robert Grandl,
Junaid Khalid, Sourav Das, Aditya Akella
 
1
 
OpenNF: Enabling Innovation in
Network Function Control
 
Network functions (NFs)
 
Perform sophisticated 
stateful
actions on packets/flows
 
2
NF trends
 
NFV → dynamically allocate NF instances
SDN → dynamically reroute flows
 
Dynamic reallocation
of packet processing
3
Xen/KVM
Example: elastic NF scaling
 
 
1.
Satisfy performance SLAs
2.
Minimize operating costs
3.
Accurately monitor traffic
4
 
CPU
 
Packet loss
 
Example: elastic NF scaling
1.
Satisfy performance SLAs
2.
Minimize operating costs
3.
Accurately monitor traffic
5
 
CPU
 
Packet loss
To 
simultaneously
 
Problem: NFV+SDN is insufficient
Cannot effectively implement
new services  or abstractions!
Why NFV + SDN falls short
6
 
?
Packet loss
SLAs + cost + accuracy:
What do we need?
 
Quickly move, copy, or share internal NF state
alongside updates to network forwarding state
Guarantees: loss-free, order-preserving, …
7
Also applies to other scenarios
 
Outline
 
Motivation and requirements
Challenges
OpenNF architecture
State export/import
State operations
Guarantees
Evaluation
 
8
 
1.
Supporting many NFs with minimal changes
2.
Dealing with race conditions
3.
Bounding overhead
Challenges
9
OpenNF overview
10
NF State Manager
Flow Manager
OpenNF
Controller
Control Application
 
move/copy/share state
 
export/import
State
 
State created or updated by an NF applies to
either a 
single flow
 or a 
collection of flows
NF state taxonomy
11
NF API: export/import state
Functions: 
get
, 
put
, 
delete
12
No need to expose/change internal state organization!
 
Filter
NF
Control operations: move
13
NF State Manager
Control Application
 
move (port=80, Bro
1
, Bro
2
)
 
get(per, port=80)
 
[Chunk1]
 
put (per, Chunk1)
 
del(per, port=80)
 
[Chunk2]
 
put (per, Chunk2)
 
forward(port=80, Bro
2
)
Flow Manager
Bro
2
Bro
1
Also provide copy and share
 
Split/Merge 
[NSDI ‘13]
: pause traffic, buffer packets
Packets in-transit when buffering starts are dropped
Lost updates during move
14
B1
R1
R2
R2
Bro
2
Bro
1
 
move(red,Bro
1 
,Bro
2 
)
Loss-free: All state updates should be reflected in the
transferred state, and all packets should be processed
R3
NF API: observe/prevent
updates using events
15
Only need to change an NF’s receive packet function!
R1
R2
B1
R1
NF
 
1.
 
enableEvents(red,drop)
 on Bro
1
2.
 
get
/
delete
 on Bro
1
3.
Buffer events at controller
4.
 
put
 on Bro
2
5.
Flush packets in
events to Bro
2
6.
Update
forwarding
Use events for loss-free move
16
Bro
2
Bro
1
R3
R1
Drop
R1
R1,R2
R2
R1,R2,R3
False positives from Bro’s 
weird
 script
Re-ordering of packets
17
Order-preserving: All packets should be processed
in the order they were forwarded by the switch
 
Controller
 
Switch
 
Bro
2
 
5. Flush buffer
 
6. Request
forwarding update
 
Bro
1
R2
R4
R3
 
1.
Dealing with diversity
2.
Dealing with race conditions
 
OpenNF: SLAs + cost + accuracy
 
18
Export/import state based
on its association with flows
 
Implementation
 
Controller (
3.8K lines of Java
)
Communication library (2.6K lines of C)
Modified NFs (3-8% increase in code)
 
19
Bro IDS
Overall benefits for elastic scaling
 
Bro IDS processing 10K pkts/sec
At 180 sec:
 move HTTP flows (489) 
to new IDS
At 360 sec:
 move 
back to old IDS
SLAs: 260ms to move (loss-free)
Accuracy: same log entries as using one IDS
VM replication: incorrect log entries
Cost: scale down after state is moved
Stratos: scale down delayed 25+ minutes
20
 
[arXiv:1305.0209]
Evaluation: state export/import
21
PRADS asset detector processing 5K pkts/sec
Move per-flow state for 500 flows
Evaluation: operations
22
Operations are efficient, but
guarantees come at a cost!
Bro: 5% of
alerts missed!
      NG         NG PL   LF PL+ER  OP PL+ER
 
Dynamic reallocation of packet
processing enables new services
Realizing SLAs + cost + accuracy requires
quick, safe control of internal NF state
OpenNF provides flexible and efficient
control with few NF modifications
 
Conclusion
 
23
 
http://opennf.cs.wisc.edu
 
Backup
 
Related work
Copy and share
Order-preserving move
Bounding overhead
Example control application
Evaluation: controller scalability
Evaluation: importance of guarantees
Evaluation: benefits of granular control
 
24
 
Virtual machine replication
Unneeded state 
 incorrect actions
Cannot combine 
 limited reallocation
Split/Merge 
[NSDI’13]
State allocations and accesses occur via library
Addresses a specific problem 
 limited suitability
Packets may be dropped or re-ordered 
→ wrong
NF behavior
 
25
 
Existing approaches
 
Copy and share operations
 
Used when multiple instances need some state
Copy – no or eventual consistency
Once, periodically, based on events, etc.
Share – strong or strict consistency
Events are raised for all packets
Events are released
one at a time
State is copied
before releasing the next event
 
26
Copy (multi-flow): 111ms
Share (strong): 13ms/packet
 
Flush packets in events to Inst
2
 
enableEvents(blue,buffer)
 on Inst
2
Forwarding update:
 send to Inst
1
 & controller
Wait for packet from
switch (remember last)
Forwarding update:
send to Inst
2
Wait for event
for last packet from Inst
2
Release buffer of packets on Inst
2
Order-preserving move
27
B1
Drop
B1
B1,B2
B1,B2,
B3
Buf
B3
B3
B4
B1,B2,
B3,B4
 
Applications decide (based on NF & objectives):
1.
Granularity of
operations
2.
Guarantees
desired
 
Bounding overhead
 
28
Example app: elastic NF scaling
 
movePrefix(prefix,oldInst,newInst):
  copy(oldInst,newInst,{nw_src:prefix},multi)
  move(oldInst,newInst,{nw_src:prefix},per,LF+OP)
  while (true):
    sleep(60)
    copy(oldInst,newInst,{nw_src:prefix},multi)
    copy(newInst,oldInst,{nw_src:prefix},multi)
scan.bro
vulnerable.bro
weird.bro
29
 
Evaluation: controller scalability
 
 
 
 
 
 
 
Improve scalability with P2P state transfers
 
30
 
Evaluation: importance
of guarantees
 
Bro
1
 processing malicious trace @ 1K pkts/sec
After 14K packets: move active flows to Bro
2
 
Evaluation: benefits
of granular control
 
HTTP requests from 2 clients (40 unique URLs)
Initially: both go to Squid
1
20s later: 
reassign Client
1
 to Squid
2
Slide Note
Embed
Share

OpenNF enables innovation in network function control by supporting various network functions, dynamic allocation of instances, and addressing challenges such as packet loss and SLA fulfillment. The architecture focuses on state export/import, operation guarantees, and efficient handling of NFs with minimal changes. It aims to enhance performance, reduce costs, and improve traffic monitoring in network environments.


Uploaded on Sep 11, 2024 | 1 Views


Download Presentation

Please find below an Image/Link to download the presentation.

The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.

E N D

Presentation Transcript


  1. OpenNF: Enabling Innovation in Network Function Control Aaron Gember-Jacobson, Chaithan Prakash, Raajay Viswanathan, Robert Grandl, Junaid Khalid, Sourav Das, Aditya Akella 1

  2. Network functions (NFs) Perform sophisticated stateful actions on packets/flows WAN optimizer Caching proxy Intrusion detection system (IDS) 2

  3. NF trends NFV dynamically allocate NF instances SDN dynamically reroute flows WAN optimizer Dynamic reallocation of packet processing Caching proxy Xen/KVM Intrusion detection system (IDS) 3

  4. Example: elastic NF scaling 1. Satisfy performance SLAs 2. Minimize operating costs 3. Accurately monitor traffic CPU Packet loss 4

  5. Example: elastic NF scaling Problem: NFV+SDN is insufficient To simultaneously 1. Satisfy performance SLAs 2. Minimize operating costs 3. Accurately monitor traffic CPU Cannot effectively implement new services or abstractions! Packet loss 5

  6. Why NFV + SDN falls short ? Packet loss SLA: <1% 1. SLAs 2. Cost 3. Accuracy ? Reroute new flows [Stratos - arXiv:1305.0209] Reroute existing flows [SIMPLE - SIGCOMM 13] Wait for flows to die [Stratos - arXiv:1305.0209] 6

  7. SLAs + cost + accuracy: What do we need? Quickly move, copy, or share internal NF state alongside updates to network forwarding state Guarantees: loss-free, order-preserving, 1 2 3 Also applies to other scenarios 7

  8. Outline Motivation and requirements Challenges OpenNF architecture State export/import State operations Guarantees Evaluation 8

  9. Challenges 1. Supporting many NFs with minimal changes 2. Dealing with race conditions Packet Route Update State 3. Bounding overhead 9

  10. OpenNF overview Control Application move/copy/share state OpenNF Controller NF State Manager Flow Manager export/import State 10

  11. NF state taxonomy State created or updated by an NF applies to either a single flow or a collection of flows Multi-flow state Per-flow state TcpAnalyzer Connection HttpAnalyzer ConnCount Connection TcpAnalyzer All-flows state Statistics HttpAnalyzer 11

  12. NF API: export/import state Functions: get, put, delete put Per Scope Multi All Filter get NF No need to expose/change internal state organization! 12

  13. Control operations: move Control Application Flow Manager move (port=80, Bro1, Bro2) forward(port=80, Bro2) NF State Manager get(per, port=80) put (per, Chunk1) [Chunk1] del(per, port=80) put (per, Chunk2) [Chunk2] Bro1 Bro2 Also provide copy and share 13

  14. Lost updates during move detect- MHR R2 R3 move(red,Bro1 ,Bro2 ) Missing state Missing updates R1 R2 B1 Bro1 Bro2 Loss-free: All state updates should be reflected in the transferred state, and all packets should be processed Split/Merge [NSDI 13]: pause traffic, buffer packets Packets in-transit when buffering starts are dropped 14

  15. NF API: observe/prevent updates using events NF R1 Only need to change an NF s receive packet function! 15

  16. Use events for loss-free move 1. enableEvents(red,drop) on Bro1 2. get/delete on Bro1 3. Buffer events at controller 4. put on Bro2 5. Flush packets in events to Bro2 6. Update forwarding R3 R1 R2 R1,R2 R1,R2,R3 R1 Drop R2 Bro1 Bro2 16

  17. Re-ordering of packets False positives from Bro s weird script Controller 5. Flush buffer 6. Request forwarding update Switch Bro2 Bro1 R2 R2 R3 R2 R3 R4 R3 R4 R3 R3 Order-preserving: All packets should be processed in the order they were forwarded by the switch 17

  18. OpenNF: SLAs + cost + accuracy 1. Dealing with diversity Export/import state based on its association with flows 2. Dealing with race conditions + Events Lock-step forwarding updates 18

  19. Implementation Controller (3.8K lines of Java) Communication library (2.6K lines of C) Modified NFs (3-8% increase in code) Bro IDS iptables Squid Cache PRADS 19

  20. Overall benefits for elastic scaling Bro IDS processing 10K pkts/sec At 180 sec: move HTTP flows (489) to new IDS At 360 sec: move back to old IDS SLAs: 260ms to move (loss-free) Accuracy: same log entries as using one IDS VM replication: incorrect log entries Cost: scale down after state is moved Stratos: scale down delayed 25+ minutes [arXiv:1305.0209] 20

  21. Evaluation: state export/import Cost grows with state complexity Serialization/deserialization costs dominate 21

  22. Evaluation: operations PRADS asset detector processing 5K pkts/sec Move per-flow state for 500 flows 881 packets in events 500 200 Per-packet Latency Packets dropped! 686 Move Time (ms) 400 150 Increase (ms) Bro: 5% of alerts missed! 300 462 100 200 50 100 0 0 Average Maximum 1120 pkts buffered NG NG NG PL LF PL+ER OP PL+ER NG PL LF PL+ER 838 pkts in events + Operations are efficient, but guarantees come at a cost! 22

  23. Conclusion Dynamic reallocation of packet processing enables new services Realizing SLAs + cost + accuracy requires quick, safe control of internal NF state OpenNF provides flexible and efficient control with few NF modifications http://opennf.cs.wisc.edu 23

  24. Backup Related work Copy and share Order-preserving move Bounding overhead Example control application Evaluation: controller scalability Evaluation: importance of guarantees Evaluation: benefits of granular control 24

  25. Existing approaches Virtual machine replication Unneeded state incorrect actions Cannot combine limited reallocation Split/Merge [NSDI 13] State allocations and accesses occur via library Addresses a specific problem limited suitability Packets may be dropped or re-ordered wrong NF behavior 25

  26. Copy and share operations Used when multiple instances need some state Copy no or eventual consistency Once, periodically, based on events, etc. Share strong or strict consistency Events are raised for all packets Events are released one at a time State is copied before releasing the next event Copy (multi-flow): 111ms Share (strong): 13ms/packet 26

  27. Order-preserving move Flush packets in events to Inst2 enableEvents(blue,buffer) on Inst2 Forwarding update: send to Inst1 & controller Wait for packet from switch (remember last) Forwarding update: send to Inst2 Wait for event for last packet from Inst2 Release buffer of packets on Inst2 B3 B3 B4 Buf B1,B2 B1,B2, B1,B2, B1 B3 B3,B4 Drop B3 B1 B2 27

  28. Bounding overhead Applications decide (based on NF & objectives): 1. Granularity of operations Per Multi Filter Scope All 2. Guarantees desired + 1 2 3 LF None LF+OP 28

  29. Example app: elastic NF scaling scan.bro vulnerable.bro weird.bro movePrefix(prefix,oldInst,newInst): copy(oldInst,newInst,{nw_src:prefix},multi) move(oldInst,newInst,{nw_src:prefix},per,LF+OP) while (true): sleep(60) copy(oldInst,newInst,{nw_src:prefix},multi) copy(newInst,oldInst,{nw_src:prefix},multi) 29

  30. Evaluation: controller scalability Improve scalability with P2P state transfers 30

  31. Evaluation: importance of guarantees Bro1 processing malicious trace @ 1K pkts/sec After 14K packets: move active flows to Bro2 Alert Incorrect file type MHR Match MD5 Total Baseline 26 31 116 173 NF 25 28 111 164 LF 24 27 106 157 LF+OP 26 31 116 173

  32. Evaluation: benefits of granular control HTTP requests from 2 clients (40 unique URLs) Initially: both go to Squid1 20s later: reassign Client1 to Squid2 Ignore 117 Crash! 0 MB Copy-client 117 39 4 MB Copy-all 117 50 54 MB Hits @ Squid1 Hits @ Squid2 State transferred

Related


More Related Content

giItT1WQy@!-/#giItT1WQy@!-/#giItT1WQy@!-/#giItT1WQy@!-/#giItT1WQy@!-/#giItT1WQy@!-/#