Slick: A control plane for middleboxes Bilal Anwer, Theophilus Benson, Dave Levin, Nick Feamster, Jennifer Rexford Supported by DARPA through the U.S. Navy SPAWAR under contract N C-4017

Network Policies Reachability – Alice can not send packets to Bob Application classification – Place Skype traffic in the gold queue

Limitations of SDN Data Plane : Fwd Port 1 A2:e3:f1:ba:ea:23:* Drop Match Action Limited actions and matching – Match: Ethernet, IP, TCP/UDP port numbers – Action: forward, drop, rewrite header, etc.

Extending SDN’s Data Plane Expand the OpenFlow standards – Requires hardware support Implement richer data plane in controller – Introduces additional latency to packets Add new devices (Middleboxes)

Example: Detecting Network Attacks Inspect all DNS traffic with a DPI device If suspicious lookup takes place, send to traffic scrubber Inspect all DNS traffic with a DPI device If suspicious lookup takes place, send to traffic scrubber

Example: Detecting Network Attacks Inspect all DNS traffic with a DPI device If suspicious lookup takes place, send to traffic scrubber Inspect all DNS traffic with a DPI device If suspicious lookup takes place, send to traffic scrubber

Example: Detecting Network Attacks Inspect all DNS traffic with a DPI device If suspicious lookup takes place, send to traffic scrubber Inspect all DNS traffic with a DPI device If suspicious lookup takes place, send to traffic scrubber

Example: Detecting Network Attacks Inspect all DNS traffic with a DPI device If suspicious lookup takes place, send to traffic scrubber Inspect all DNS traffic with a DPI device If suspicious lookup takes place, send to traffic scrubber

Challenges Specify network policies across middleboxes – Difficult to automatically react to middlebox events Dynamically place sophisticated middleboxes – Difficult to determine efficient placement – Difficult to adjust placement to traffic patterns Support for arbitrary middlebox functionality – Difficult to capture hardware requirements

Slick Contributions Abstraction for programming middleboxes – Simplifies the development of network policies – Separates specification of intent from implementation Dynamic placement of middlebox functionality – Online resource allocation algorithm Support for heterogeneous devices – Maintains performance profiles of middlebox

Slick Architecture Slick Controller Middlebox Element Middlebox Element Middlebox Element Middlebox Element Application Encodes network policy Provides handlers for triggers Encodes network policy Provides handlers for triggers Piece of code encapsulating middlebox functions Your network operator 3 rd party element developers Programmable device: NetFPGA, x86 server Virtual Switch Triggers from elements

Slick Architecture Slick Controller Application Runs applications Runs resource allocation algo. Places middlebox elements Steers traffic through middleboxes Configures switches Runs applications Runs resource allocation algo. Places middlebox elements Steers traffic through middleboxes Configures switches Installs/uninstalls middlebox functions Deploy Middlebox code Middlebox Element Middlebox Element Middlebox Element Middlebox Element Programmable device: NetFPGA, x86 server Virtual Switch

Slick Controller Features Resource allocation heuristic – Minimizes latency  minimize path length Dealing with heterogeneity – Algorithms for discovering hardware – Model of middlebox performance

Slick Controller Features Resource allocation Heuristic – Inputs: – Constraint: Hardware limitations of slick servers – Objective: minimize latency, maximize throughput Dealing with heterogeneity – Different hardware provides different throughput – Mapping of elements to acceptable hardware – Create models for automatically characterizing elements

Resource Allocation Heuristic Resource allocation heuristic Resource allocation heuristic Traffic Steering OpenFlow Controller OpenFlow Controller Placement Decisions Traffic matrix And topology Network policies in applications Middlebox perf profile Hardware constraints Programmable device Virtual Switch Programmable device Virtual Switch Objective: minimize latency (path lengths)

Status and Conclusion Slick: control plane for middleboxes – Presented an initial architecture – Discussed algorithmic challenge Slick is implemented in python – Slick controller as a module on NoX – Developed 2 applications and 3 middlebox elements

Current Status Slick is implemented in python – Slick controller as a module on NoX – Developed 2 applications and 3 middlebox elements

Conclusion and Open Questions Slick: control plane for middleboxes – Presented an initial architecture – Discussed algorithmic challenge Open questions – How can developers help guide placement? – What is the optimal solution for resource allocation?

Questions?

Related Work CoMB [NSDI ’12] – Calculations are off-line – Focuses on placement (paths are fixed) PLayer [Sigcomm ‘08] – Focuses solely on traffic steering Point solutions lacking the generality to allow operators to generate dynamic policies