Ranges & Cross-Entrance Consistency with OpenFlow Liron Schiff (TAU) Joint work with Yehuda Afek (TAU) Anat Bremler-Barr (IDC) Israel Networking Day 2014

Issue 1: Ranges ActionEndStart Server r Server r Server r Drop ……………….. Source IP Address replicas Internet … Firewalls Load Balancers DDoS mitigation Forwarding …….

Issue 2: Cross-Entrance Consistency replicas … client’s IPs Internet SDN Network

Contributions Ranges: Efficient implementation w/ OpenFlow – 2 entries per range; total, 2n vs. Previously n∙w table entries (n number of intervals, w field size, usually 16 or 32) Consistent & Atomic ranges update – Per packet, and per flow consistency Cross entrance consistency (with ranges)

Ranges Current Solution: Expansion ActionEndStart Server A Server B ActionPattern Server A [00111***] Server A [*1******] Server A [10******] Server A 125. [ ].*.* Server A 125. [000111**].*.* Server A 125. [001000**].*.* Server A 125.[ ].*.* Server A 125.[ ] Server B 125.[ ]. 255.* Server A 125.[ ]. *.* Server B 125.[001*****].*.* Server B *.* Server B [00******].* Server B [010*****].* Server B [011000**].* Server B [0010****] Server B [ ] Server B [ ] 2w – 4 entries per range

Current Solution: Range Update Change affects several entries Need atomicity (while traffic passes thru) Packet buffering, or duplicating and switching tables ActionPattern Server A [00111***] Server A [*1******] Server A [10******] Server A 125. [ ].*.* Server A 125. [000111**].*.* Server A 125. [001000**].*.* Server A 125.[ ].*.* Server A 125.[ ] Server B 125.[ ]. 255.* Server A 125.[ ]. *.* Server B 125. [001*****].*.* Server B *.* Server B [00******].* Server B [010*****].* Server B [011000**].* Server B [0010****] Server B [ ] Server B [ ] ActionEndStart Server A Server B Flow table ActionPattern Server A 125.[ ] Server B 125.[ ]. 255.* Server A 125.[ ]. *.*

Our Ranges Implementation 2 entries per range Atomic (create, delete, split, merge) with O(1) control message complexity. merge split

[Panigrahy&Sharma2003] TCAM range implementation TCAM Query Compare

Adapting [PS2003] to OpenFlow Even Comparisons are Flow-Table based! Flow Table Query Flow Table Query Compare Flow Table based comparisons

OpenFlow based Comparison patterns 0*******1******* 0******* *0*******1****** *0****** ******** Result m>q m<q m>q m<q m=q qm Packet header

Issue 2: Cross Entrance Consistency

Per-Flow Consistency [Reitblatt, Foster, Rexford, Schlesinger, Walker 2012] Internet replicas client’s IPs …

Internet replicas client’s IPs Change in weights  Change in ranges … ActionEndStart Server Server But existing flow shouldn’t change Per-Flow Consistency [Wang, Butnariu, Rexford, 2011]

Per-Flow Consistency solution [Wang et.al.] Internet replicas client’s IPs … Controller ActionEndStart Server Server Send flows in affected sub range to controller

Internet replicas client’s IPs … Controller ActionEndStart Server Server Server Add specific rules for existing flows Per-Flow Consistency solution [Wang et.al.]

Internet replicas client’s IPs … Richer OpenFlow interface (e.g. DevoFlow) can solve this locally in the switch and save control communication. Richer OpenFlow interface (e.g. DevoFlow) can solve this locally in the switch and save control communication. Controller DevoFlow Per-Flow Consistency solution [Wang et.al.]

DevoFlow Src IPDst IPAction *.*.*Forward port 3 Src IPDst IPAction Devo Rules Standard Rules Src IPDst IP Packet Forward port 3 [Mogul, Tourrilhes, Yalagandula, Sharma, Curtis, Banerjee 2010]

DevoFlow Src IPDst IPAction *.*.*Forward port 5 Src IPDst IPAction Forward port 3 Devo Rules Standard Rules Src IPDst IP Packet Forward port 5

Internet replicas client’s IPs … Richer OpenFlow interface (e.g. DevoFlow) can solve this locally in the switch and save control communication. Richer OpenFlow interface (e.g. DevoFlow) can solve this locally in the switch and save control communication. Controller DevoFlow Per-Flow Consistency solution [Wang et.al.]

Cross-Entrance Consistency replicas … client’s IPs Internet X Controller SDN Network Local solution is not possible We must sync between entrances Local solution is not possible We must sync between entrances

Implementing Cross-Entrance Consistency replicas … client’s IPs Internet Controller DevoFlow + SYN match DevoFlow + SYN match Richer OpenFlow interface (e.g. DevoFlow and SYN matching) can reduce control communication. DevoFlow + SYN match DevoFlow + SYN match

Consistency Costs Consistency model Special features Control trafficFlow delay and buffering Per flow NoHigh Devoflow None Cross entrance NoHigh Devoflow Low: O(flows*entrances) Low (only SYNs)

summary Efficient Ranges implementation Multi-entrance consistency

Questions ?