1. CEDAR Counter-Estimation Decoupling for Approximate Rates Erez Tsidon Joint work with Iddo Hanniel and Isaac Keslassy Technion, Israel 1

2. Network Flow Counters Usage  Network management applications require per-flow counters, for example:  Congestion Control  Detection of Denial of Service Attacks  Detection of Traffic Anomalies  Counter types:  Packet counting  Byte counting  Rate measurement 2

3. Switch Example DRAM is too slow, SRAM is too expensive 3 10 6 flows Total Packet Count Total Byte Count Packet Rate Count event A Count event B per-flow counters 64-bit width High Speed Link Rate 10Gbps Time frame of each packet is too short for DRAM access Too much data to store on SRAM

4. Suggested Solutions  Hybrid SRAM-DRAM counters [Shah, Iyer, Prabhakar and McKeown ’02]  Cannot support fast reading  Counter Braids – compress counters into small SRAM [Y. Lu et al ’08]  Cannot decompress in real time  Heavy Hitters – store only high counters [Estan and Varghese ’03]  No records of small counter values 4

5. Counter Estimation Solutions  Probabilistic way to estimate counters  Less bits per counter, but estimation error cost Intuitively we want counters to be as precise as possible, unbiased whenever possible, and scalable  SAC – R. Stanojevic, “Small Active Counters”, 2007 SAC  Exponent-Magnitude representation  Scalable Restricted to specific representation that prevents error optimization  DISCO – C. Hu et al, “DISCO: Memory Efficient and Accurate Flow Statistics for Network Measurement”, 2010 DISCO  Convex conversion function that reduces increment values Restricted to a close function representation. No scaling 5

6. Our Contributions  New CEDAR architecture: decoupling counters from estimators  Optimal estimators for the min-max relative error  Dynamic up-scale algorithm 6

7. CEDAR Architecture: Counter-Estimators Decoupling 7 995,784 1.2 1,000,000 1.2 Counter estimates F N-1 F N-2 F1F1 F0F0 1,000,000 995,784 1.2 0 p(L-2) p(1) p(L-1) p(1) A L-1 A L-2 A1A1 A0A0 3.7 A2A2 Flow pointers Shared estimators F N-1 F N-2 F1F1 F0F0

8. 0 1 44 CEDAR Increment Algorithm 9 4 1 A3A3 A2A2 A1A1 0 A0A0 211 132 54.7 11 A7A7 A6A6 A5A5 A4A4 9 4 1 0 211 132 54.7 11 9 4 1 0 211 132 54.7 11 9 4 1 0 211 132 54.7 11 time p=1 p=1/3 p=1/5 t=0t=1t=2t=3 8 Upon packet arrival: with probability

9. Performance Measures  Traffic Amount : random variable that represents the number of real counter increments until we hit estimator  Relative error:  Known as “Coefficient of Variation”  E.g. we may want a relative error of 1% 9

10. Min-Max Relative Error  Problem: given A L-1 =M, find an estimation array that minimizes the maximal relative error δ such that:  Equivalently: δ is given  maximize M  Solution – equal relative error: 10

11. Equal Relative Error Example 11 Estimation Values Relative Error δ δ A1A1 A2A2 A3A3 A1A1 A2A2 A3A3 δ A1A1 A2A2 A3A3

12. Capacity Region of Static CEDAR 12 Example: 12-bit counters Max value 10^6  min-max relative error 3%

13. 4.5 1 Up-Scale Procedure 3 1 A3A3 A2A2 A1A1 0 A0A0 211 132 54 11 A7A7 A6A6 A5A5 A4A4 24 5 2 0 517 314 156 93 54 11 p=0.5 0 p=0.43 =(54-24)/(93-24) 93 13 A’A’’ Up-scale threshold Initial relative error δ 0 Increase the relative error δ 0 + δ step

14. CEDAR Unbiasedness 14 Based on a real Internet trace. δ 0 = 1%, δ step = 0.5%

15. CEDAR Equal Error 15

16. CEDAR Vs. SAC & DISCO 12-bit 16 4096 estimators

17. CEDAR Vs. SAC & DISCO 8-bit 17 256 estimators

18. CEDAR Error Adjustment 12-bit 18

19. CEDAR Implementation on FPGA 19 5.4 Gbps 12K gates

20. CEDAR Summary  Decoupling  flexible estimators  Scalable estimation  Attains the min-max relative error  FPGA supports link rate of 5.4Gbps and may increase to tens of Gbps on ASIC 20

21. Thank you. 21