Yehuda Afek TAU Research Track Session Part 1 ONS2015: http://bit.ly/ons2015sd ONS Inspire! Webinars: http://bit.ly/oiw-sd Watch the talk (video) on ONS Content Archives: http://bit.ly/ons-archives-sd

3. Ranges &
Cross-Entrance Consistency with
OpenFlow
Yehuda Afek (TAU)
Liron Schiff (TAU)
Anat Bremler-Barr (IDC)
ONS 2014

4. Issue 1: Ranges
ActionEndStart
Server r361.26.188.550.0.0.0
Server r161.37.255.061.26.188. 56
Server r293.2.100.5061.37.255.1
Drop127.0.64.4093.2.100.51
………………..
Source IP Address
replicas
Internet
…
Firewalls
Load Balancers
DDoS mitigation
Forwarding
…….

5. Issue 2: Cross-Entrance Consistency
replicas
…
client’s IPs
Internet
X
SDN Network

6. Contributions
• Ranges: Efficient implementation w/ OpenFlow
–2 entries per flow;
total, 2n vs. Previously n∙w table entries
(n number of intervals, w field size, usually 16 or 32)
• Consistent & Atomic ranges update
– Per packet, and per flow consistency
• Cross entrance consistency (with ranges)

7. Ranges Current Solution: Expansion
ActionEndStart
Server A125.37.255.0125.26.188. 56
Server B126.2.100.50125.37.255.1
ActionPattern
Server A125.26.188. [00111***]
Server A125.26.188. [*1******]
Server A125.26.188. [10******]
Server A125. [00011011].*.*
Server A125. [000111**].*.*
Server A125. [001000**].*.*
Server A125.[00100100].*.*
Server A125.[00100101]. 255.0
Server B125.[00100101]. 255.*
Server A125.[00100101]. *.*
Server B125.[001*****].*.*
Server B126. 1.*.*
Server B126. 2. [00******].*
Server B126. 2. [010*****].*
Server B126. 2. [011000**].*
Server B126. 2. 100.[0010****]
Server B126. 2. 100.[00110001]
Server B126. 2. 100.[00110010]
2w – 4 entries per range

8. Current Solution: Range Update
• Change affects several entries
• Need atomicity (while traffic passes thru)
• Packet buffering, or
duplicating and switching tables
ActionPattern
Server A125.26.188. [00111***]
Server A125.26.188. [*1******]
Server A125.26.188. [10******]
Server A125. [00011011].*.*
Server A125. [000111**].*.*
Server A125. [001000**].*.*
Server A125.[00100100].*.*
Server A125.[00100101].255.0
Server B125.[00100101]. 255.*
Server A125.[00100101]. *.*
Server B125. [001*****].*.*
Server B126. 1.*.*
Server B126. 2. [00******].*
Server B126. 2. [010*****].*
Server B126. 2. [011000**].*
Server B126. 2. 100.[0010****]
Server B126. 2. 100.[00110001]
Server B126. 2. 100.[00110010]
ActionEndStart
Server A125.37.255.0125.26.188. 56
Server B126.2.100.50125.37.255.1
36
36
Flow table
ActionPattern
<EMPTY>
Server A125.[00100100].255.0
Server B125.[00100100]. 255.*
Server A125.[00100100]. *.*

9. Our Ranges Implementation
• 2 entries per range
• Atomic (create, delete, split, merge)
with O(1) control message complexity.
merge
split

10. [Panigrahy&Sharma2003] TCAM range
implementation
TCAM Query
TCAM Query
CompareCompare

11. Adapting [PS2003] to OpenFlow
• Even Comparisons are Flow-Table based!
Flow Table
Query
Flow Table
Query
Compare
Compare
Flow Table based comparisons

12. OpenFlow based Comparison
patterns
0*******1*******
1*******0*******
*0*******1******
*1*******0******
.
.
.
.
.
.
****************
Result
m>p
m<p
m>p
m<p
.
.
.
m=p
qm
Packet
header

13. Issue 2: Cross Entrance
Consistency

14. Per-Flow Consistency
[Reitblatt, Foster, Rexford, Schlesinger, Walker 2012]
Internet
replicas
client’s IPs
…

15. Internet
replicas
client’s IPs
Change in weights 
Change in ranges
…
ActionEndStart
Server 2125.37.255.0125.26.188. 56
Server 3126.2.100.50125.37.255.1
36
36
But existing flow
shouldn’t change
Per-Flow Consistency
[Wang, Butnariu, Rexford, 2011]

16. Per-Flow Consistency solution [Wang et.al.]
Internet
replicas
client’s IPs
…
Controller
ActionEndStart
Server 2125.37.255.0125.26.188. 56
Server 3126.2.100.50125.37.255.1
36
36
1. Send flows in
affected sub range to
controller

17. Internet
replicas
client’s IPs
…
Controller
ActionEndStart
Server 2125.37.1.1125.37.1.1
Server 2125.37.255.0125.26.188. 56
Server 3126.2.100.50125.37.255.1
36
36
2. Add specific rules
for existing flows
Per-Flow Consistency solution [Wang et.al.]

18. Internet
replicas
client’s IPs
…
Richer OpenFlow interface (e.g. DevoFlow) can solve this
locally in the switch and save control communication.
Controller
DevoFlow
Per-Flow Consistency solution [Wang et.al.]

19. Cross-Entrance Consistency
replicas
…
client’s IPs
Internet
X
Controller
SDN Network
Local solution is not possible
We must sync between entrances

20. Implementing Cross-Entrance Consistency
replicas
…
client’s IPs
Internet Controller
DevoFlow +
SYN match
DevoFlow +
SYN match
Richer OpenFlow interface (e.g. DevoFlow and SYN
matching) can reduce control communication.

21. summary
• Efficient Ranges implementation
• Multi-entrance consistency

22. Questions ?