1. Oct 11, 2000 1 OpenSig, Napa, California Silicon-based Programmable Routers: What have we learned? Tal Lavian - Nortel Networks Labs tlavian@nortelnetworks.comtlavian@nortelnetworks.com 408-495-3062 More info: http://www.openetlab.org Franco Travostino, Phil Wang, Rob Duncan

2. Oct 11, 2000 2 OpenSig, Napa, California We are part of research organization. This talk describes exploratory research. Nortel makes no commitment to turn this technology into products. Nortel makes no commitment to do anything with the ideas described in this talk. Usual Disclaimer

3. Oct 11, 2000 3 OpenSig, Napa, California What have we learned? We have implemented programmable (Java) Gigabit Routing Switch (backplane 256 Gbs) Infinite Bandwidth, Wire speed routing & Streaming media, drive New Types of intelligence on programmable network device Dynamic monitoring and modification of silicon knobs —The granularity is streams and not packets —Short time granularity (part of apps and not human intervention, keyboard, telnet, cli, snmp)

4. Oct 11, 2000 4 OpenSig, Napa, California Agenda Programmability - market drivers Infinite bandwidth drives the need for programmability Architecture Separation of Control and Data planes Example - Dynamic Classification Summary

5. Oct 11, 2000 5 OpenSig, Napa, California IBM CDC Digital Amdel Applications OSs Peripherals Hardware 1980s - Vertical Industry 2000s - Horizontal Industry Industry Movement from Vertical toward Horizontal Markets

6. Oct 11, 2000 6 OpenSig, Napa, California Incomplete transformation; the inflection point is quickly approaching … Cisco Nortel Juniper 3Com Network & Mgmt services Embedded OS System ASICs “00 Vertical Network Industry Horizontal Network Industry Inflection Points Ahead of Us

7. Oct 11, 2000 7 OpenSig, Napa, California Infinite Bandwidth Infinite Bandwidth Why this change the playground? Are we ready for streaming media on the net? –Peer to Peer – Napster, 6000 radio stations –Streaming video, multicast, Napster video is coming –Web traffic will be minor (streaming is constant) 3-4 orders of magnitudes bandwidth growth in many dimensions – Access – Cable, DSL, 3G – (28kbs  10mbs, 1.5mbs, 384kbs) – Core – Optical bandwidth - (155mbs  1Tbs) – LAN – (10mbps  10Gbps) Silicon Wire-speed routing

8. Oct 11, 2000 8 OpenSig, Napa, California Bottlenecks in Programmable Routing The streaming media demand & the infinite bandwidth will drive the need for programmability and dynamic services on the net Need programmability to drive this booming demand. Software based routers can’t do it. Unlike Linux routers and software based routers, we can’t add software to the data plane —Data plane : Wire speed silicon forwarding, multi Gigabit —Control plane : –Can’t see the data in wire speed. –Can dynamically modify the silicon knobs

9. Oct 11, 2000 9 OpenSig, Napa, California Programmable Services - Locations Service-enablement will prove most effective where “impedance mismatches” occur in the network — Optical vs. Wireline (3-4 oom) — Wireline vs. wire-less (3-4 oom) — Secure vs. non-secure — Customer-premises vs. Content-provider-land (3-4 oom) — SLA (x) vs. SLA (y) — Resource-constrained vs. unwashed unlimited computing A service-enabled box can wear multiple hat oom – Order of Magnitude

10. Oct 11, 2000 10 OpenSig, Napa, California Emancipation of a Router It all started from old-world, vertically-integrated code. ASICs/Processors Proprietary Apps Proprietary NOS

11. Oct 11, 2000 11 OpenSig, Napa, California Routers Emancipation Extroverted APIs extend a commodity Java runtime. Extroverted APIs Introverted APIs APIs ASICs/Processors Forwarding Engine JVM JAPIs ISV’s Software

12. Oct 11, 2000 12 OpenSig, Napa, California Java-enabled Device Architecture Operation System JVM Oplet Oplet Runtime Env Download Hardware Routing Code Native APIs Oplet

13. Oct 11, 2000 13 OpenSig, Napa, California Network Device Dynamic loading Example: Downloading Intelligence Example: Downloading Intelligence HW OS JVM React Monitor Authentication Security Intelligence application

14. Oct 11, 2000 14 OpenSig, Napa, California Separation of Control and Forwarding Planes Centralized, CPU-based Router Forwarding-Processors Based Router Based Router Control + Forwarding Functions combined Control separated from forwarding CPU Routing SW CPU Control Plane Forwarding Processor Forwarding Processor Forwarding Processor SlowWire Speed

15. Oct 11, 2000 15 OpenSig, Napa, California Switching Fabric CPU System Forwarding Plane (Wire Speed Forwarding) Forwarding Processor Forwarding Rules Statistics &Monitors Forwarding Processor Forwarding Rules Statistics &Monitors Forwarding Processor Forwarding Rules Statistics &Monitors... Programmable Networking Control Plane ORE Network Services Traffic Packets Filtered packetsNew rules JFWD

16. Oct 11, 2000 16 OpenSig, Napa, California But Java is Slooowwwww Not appropriate in the fast-path data forwarding plane —forwarding is done by ASICs or NPUs —packet processing not affected Java applications run on the CPU —Packets designated for Java application are pushed into the control plane

17. Oct 11, 2000 17 OpenSig, Napa, California Simple Example: Fine grain monitoring Imagine a SNMP-based network with: —100 nodes —each node with 100 ports —each port with 100 conditions —all being checked 100 times a second That’s 10 billion SNMP variable accesses every second. And that’s a significant load on the NMS and the network as a whole. It’s not going to work.

18. Oct 11, 2000 18 OpenSig, Napa, California Switching Fabric CPU Wire Speed Forwarding Processor Forwarding Rules Statistics &Monitors Forwarding Processor Forwarding Rules Statistics &Monitors Forwarding Processor Forwarding Rules Statistics &Monitors Control Plane... Silicon-based Forwarding Engines

19. Oct 11, 2000 19 OpenSig, Napa, California Real-time Forwarding Stats and Monitors CPU SW HW Apps Forwarding Processor Forwarding Rules Statistics &Monitors Forwarding Processor Forwarding Rules Statistics &Monitors Forwarding Processor Forwarding Rules Statistics &Monitors

20. Oct 11, 2000 20 OpenSig, Napa, California Dynamic Classification Objectives Implement flow performance enhancement mechanisms without introducing software into data forwarding path —Service defined packet processing in a silicon-based forwarding engine —Dynamic packet classifier

21. Oct 11, 2000 21 OpenSig, Napa, California Dynamic - On the Fly Configuration Forwarding Processor Forwarding Processor Packet PolicyFilters Dynamic Apps Packet Filte r

22. Oct 11, 2000 22 OpenSig, Napa, California 5-tuple Filtering List Source Address Source Port Destination Address Destination Port Protocol Copy the packet to the control plane Don't forward the packet Set TOS field Set VLAN priority Adjust priority queue JFWD 5-tuple Filtering Dynamic Filtering Layer 4-7 in new hardware Utilize Network Processors capabilities

23. Oct 11, 2000 23 OpenSig, Napa, California Experimental Setup 100 Mbps Source 2 tcp_send() 100 Mbps Destination 1. tcp_recv() 2. tcp_recv() Source 1 tcp_send() Acclear 1100B Routing Switch 100 Mbps Rob Jaeger, Jeff Hollingsworth, Bobby Bhattacharjee - University of Maryland

24. Oct 11, 2000 24 OpenSig, Napa, California Streams Programmability

25. Oct 11, 2000 25 OpenSig, Napa, California Dynamic Classification Identify real-time flows (e.g. packet signature or flowId ) 1Use CarbonCopy filters to deliver multimedia control protocols to control plane –e.g. SIP, H.323. RTCP –Determine dynamically assigned ports from control msgs 2Use CarbonCopy filters to sample a number of packets from the physical port and identify RTP packets/signature Set a packet processing filter for packet signature to: —adjust DS-byte OR —adjust priority queue

26. Oct 11, 2000 26 OpenSig, Napa, California Dynamic Classification Without introducing software into data path we performed Dynamic Classification of flows in a Silicon-Based Gigabit Routing Switch —Introduced a new service to a Gigabit Routing Switch —Identified real-time flows —Performed policy-based flow behavior classification —Adjusted DS-byte value —Showed that flow performance can be improved Let Open Programmability and Innovation to build end-to-end network solutions and services

27. Oct 11, 2000 27 OpenSig, Napa, California Nortel’s Openet.lab It’s an incubator for service-enabled network nodes and sample services It provides: —JVM-emancipated prototypes of Nortel routers —Java APIs to MIBs —Java APIs to Forwarding Planes, packet capturing —A runtime environment for downloaded code Open Source at http://www.openetlab.orghttp://www.openetlab.org

28. Oct 11, 2000 28 OpenSig, Napa, California Closing remark Back then, thrust wasn’t a problem; control was. Likewise, network bandwidth isn’t the problem, control is. It demands our collective efforts Wright brothers 1904

29. Oct 11, 2000 29 OpenSig, Napa, California Q&A

30. Oct 11, 2000 30 OpenSig, Napa, California Appendix

31. Oct 11, 2000 31 OpenSig, Napa, California Multiple points of view NMS AB It is possible for node A to lose network “visibility” to node B, even though the NMS has visibility to both The NMS is the traditional PoV for observing the network Being able to move the management PoV out of the NMS and into the managed nodes would help

32. Oct 11, 2000 32 OpenSig, Napa, California Mobile diagnostics Similar to multiple points of view Blocking DoS at ingress into the network is best Inject mobile agent into the network at the node where the DoS is first detected The agent moves from node to node towards the DoS traffic source A bit like an immune system

33. Oct 11, 2000 33 OpenSig, Napa, California Active Intrusion Detection Intruder is identified by Intrusion Detection software Intruder signature is identified Mobile agent is dispatched in direction of intruder (based on physical port of entry) Mobile agent “chases” and terminates intruder (shuts down link, reboot host, notify NMS)

34. Oct 11, 2000 34 OpenSig, Napa, California Diagnostic Mobile Agents Automatic trace-route from edge router where problem exists —Each node reached generates a report to NMS —Trace-route code “moves” to next node in path —Mobile agents identify router health —Create logs for NMS

35. Oct 11, 2000 35 OpenSig, Napa, California Apps - Routing Relationship Download Oplet Service to the router. Monitor router locally Report “events” to App server Allow Service to take action Download application Adjust parameters based on direction from app server Monitor Appropriate Application Download Complex Condition Exceeded App Server router Extensive access to internal resources

36. Oct 11, 2000 36 OpenSig, Napa, California Collaboration with Applications New paradigm of distributed applications Network devices collaborating with applications Application aware routing JVM Servers RMI, XML, CORBA Apps Routers Switches JVM Apps Apps Server Oplet

37. Oct 11, 2000 37 OpenSig, Napa, California Router Server Collaboration Supports distributed computing applications in which network devices participate —router to router —server to router Supports Intelligent Agents Supports Mobile Agents Java-based Application Java-based Application Java-based Application

38. Oct 11, 2000 38 OpenSig, Napa, California Strong Security in the New Model The new concept is secure to add 3rd party code to network devices —Digital Signature —Administrative “Certified Optlet” —No access out of the JVM space —No pointers that can do harm —Access only to the published API —Verifier - only correct code can be loaded —Class loader access list —JVM has run time bounds, type, and execution checking