USING PACKET HISTORIES TO TROUBLESHOOT NETWORKS Presented by: Yi Gao Emnets Seminar

Operating Networks is Hard Existing network troubleshooting tools traceroute, ping, SNMP, NetFlow, sFlow, … We are still far from an era of automated troubleshooting What we want to ask the network

Packet History The route a packet takes through a network plus the switch state and header modifications it encounters at each hop

Basic Idea Send a control message (postcard) at each hop In each postcard A copy of the packet header The switch ID The output ports A version number for the switch forwarding state Collect and analyze postcards at a server

NetSight Architecture

Outline Life of a postcard History assembly Postcard compression Use packet histories Evaluation

Life of a Postcard

Life of a Postcard (Cnt.) Step 1: From switch to server

Life of a Postcard (Cnt.) Step 2: From servers to servers

Life of a Postcard (Cnt.) Step 3: From servers to disks

History Assembly Step 3 in the life of a postcard From multiple postcards to assemble a packet history, in case of reordering Solution Packet ID hash Topological sort

Postcard Compression Step 2&3 in the life of a postcard In step 2: Intra-flow compression In step 3: Inter-flow compression

Use Packet Histories Packet history filter Applications ndb netwatch netshark nprof

Use Packet Histories - PF Postcard Filters (PF) A filter to match a packet at a hop (a postcard) A PF for a packet with source IP A, entering switch S at any input port other than port P

Use Packet Histories - PHF Packet History Filter (PHF) To express interest in packet histories Let X be a PF start at X: ^{{X}} end at X: {{X}}$ go through X: {{X}}

Use Packet Histories - Applications Network Profiler Profile a particular link {{--dpid X --outport p}} Reachability Error a PHF to specify packets from A destined for B that never reach the intended final hop ^{{--bpf "ip src A and dst B" --dpid X --inport p1}}[^{{-- dpid Y --outport p2}}]*$

Evaluation – PHF matching latency

Evaluation - Overhead Without compression 31% With compression 3% ~ 7%

Summary Language Packet History Filter concisely represents packet histories of interest Applications A suite of network diagnosis apps built atop the NetSight API Platform The design, implementation, and evaluation of NetSight

Thanks!