Incremental Consistent Updates Naga Praveen Katta Jennifer Rexford, David Walker Princeton University

Policy : Collection of Openflow rules in the entire network Network Policy ===

From old policy Policy Update ===

From old policy to new policy Policy Update ===

Inconsistent policy during transition === ======

Inconsistent policy during transition === ======  Per Packet Consistency (Reitblatt et. al. SIGCOMM’12) A packet sees either exclusively the old policy or exclusively the new policy.  Per Packet Consistency (Reitblatt et. al. SIGCOMM’12) A packet sees either exclusively the old policy or exclusively the new policy.

Both old and new policy on the network

100% space overhead in intermediate steps

 Problem Statement Can we do a consistent update with less space?  Problem Statement Can we do a consistent update with less space?

 Less space overhead but more update time  Goals General : Works for any policy (with ternary matches) Efficient : No packet-processing overhead on the controller Trade Space for time 10

 Less space overhead but more update time  Goals General : Works for any policy (with ternary matches) Efficient : No packet-processing overhead on the controller Trade Space for time 11  Divide entire update into multiple rounds 1.Each round is assigned a set of predicates (predicate : a symbolic ingress packet) 2.Each round updates policy slice for assigned predicates  Slice : rules effecting the packets of a predicate  Divide entire update into multiple rounds 1.Each round is assigned a set of predicates (predicate : a symbolic ingress packet) 2.Each round updates policy slice for assigned predicates  Slice : rules effecting the packets of a predicate

Update the policy slice by slice ===

Update the policy slice by slice ===

Update the policy slice by slice ===

Update the policy slice by slice ===

Update the policy slice by slice ===

Update the policy slice by slice ===

Update the policy slice by slice ===  Given a predicate, how do you compute the slice?  How do you update the network with policy slices?  How do you assign predicates to slices?  Given a predicate, how do you compute the slice?  How do you update the network with policy slices?  How do you assign predicates to slices?

1. Computing a slice for a given predicate 19 Collect matching rules from all switches?

01->  Header Modifications  Multiple predicates match a single rule  Packets of predicate never reach a switch. 01 Challenges in computing a slice 20 0* 01 11

Compute policy slice using symbolic execution Similar to Header Space Analysis (NSDI 2012)

Compute policy slice using symbolic execution

Compute policy slice using symbolic execution ===

Similarly compute the old slice ===

2. Update policy slice – Add the new slice ===

Then remove the old slice? ===

Cannot remove 1* rule till both 10 and 11 migrate > > > > > 2 1* -> > 2 Difficult with multiple dependent predicates 27

Cannot remove 1* rule till both 10 and 11 migrate > > > > > 2 0* -> > 2 Difficult with multiple dependent predicates 28  Keep track of all dependent predicates Add a new rule as soon as any new slice needs it Delete an old rule as soon as no old slice needs it

 Optimal order of updates How many slices in total? Which predicates in which slice? 3. Choosing the predicates? 29

 Divide N ingress predicates into K ordered slices optimally Avoid exponential preprocessing Cannot consider slices in isolation Choosing the predicates 30

 Divide N ingress predicates into K ordered slices optimally Avoid exponential preprocessing Cannot consider slices in isolation  Pose it as a Mixed Integer Program Combine individual predicate symbolic analyses Encode dependency counting Choosing the predicates 31  Trade-off dimensions Rule space overhead Update time (# rounds/slices) Traffic volume of migrated rules  Trade-off dimensions Rule space overhead Update time (# rounds/slices) Traffic volume of migrated rules

 Fattree topology - 24 Switches, 576 hosts  Load Balancer Policy Each client chooses server randomly Packet modification at the ingress Shortest path forwarding to servers  Optimization solver Always within 1% in few (~5) seconds Evaluation 32

Overhead decreases significantly with increased rounds 33 Space Overhead (%) Consistent Updates Total number of slices

Minimizing update times finishes in just 9 slices 34 Switch space overhead capped at 5% Number of slices updated

80% traffic migrates in slice 1 and 99% in 3 slices 35 Switch space overhead capped at 5% Number of slices updated

 Policy abstractions come with a cost  How to implement efficiently?  Keeping the essence of abstraction  Optimizing consistent updates  Slice by slice policy update  Symbolic execution and MIP reduction Uses less rule space Moves high volume flows early Conclusion 36

Questions? Naga Praveen Katta

1.Update only parts of the network that change [Reitblatt et al] 100% overhead on policies that differ completely 2.Redirect traffic to controller [Rick McGeer, HotSDN 2012] Performance overhead 3.SWAN & zUpdate [SIGCOMM ‘13] Specialized for TE, do not consider general policies Related Work 38