1. Ranges & Cross-Entrance Consistency with OpenFlow Liron Schiff (TAU) Joint work with Yehuda Afek (TAU) Anat Bremler-Barr (IDC) Israel Networking Day 2014

2. Issue 1: Ranges ActionEndStart Server r361.26.188.550.0.0.0 Server r161.37.255.061.26.188. 56 Server r293.2.100.5061.37.255.1 Drop127.0.64.4093.2.100.51 ……………….. Source IP Address replicas Internet … Firewalls Load Balancers DDoS mitigation Forwarding …….

3. Issue 2: Cross-Entrance Consistency replicas … client’s IPs Internet SDN Network

4. Contributions Ranges: Efficient implementation w/ OpenFlow – 2 entries per range; total, 2n vs. Previously n∙w table entries (n number of intervals, w field size, usually 16 or 32) Consistent & Atomic ranges update – Per packet, and per flow consistency Cross entrance consistency (with ranges)

5. Ranges Current Solution: Expansion ActionEndStart Server A125.37.255.0125.26.188. 56 Server B126.2.100.50125.37.255.1 ActionPattern Server A 125.26.188. [00111***] Server A 125.26.188. [*1******] Server A 125.26.188. [10******] Server A 125. [00011011].*.* Server A 125. [000111**].*.* Server A 125. [001000**].*.* Server A 125.[00100100].*.* Server A 125.[00100101]. 255.0 Server B 125.[00100101]. 255.* Server A 125.[00100101]. *.* Server B 125.[001*****].*.* Server B 126. 1.*.* Server B 126. 2. [00******].* Server B 126. 2. [010*****].* Server B 126. 2. [011000**].* Server B 126. 2. 100.[0010****] Server B 126. 2. 100.[00110001] Server B 126. 2. 100.[00110010] 2w – 4 entries per range

6. Current Solution: Range Update Change affects several entries Need atomicity (while traffic passes thru) Packet buffering, or duplicating and switching tables ActionPattern Server A 125.26.188. [00111***] Server A 125.26.188. [*1******] Server A 125.26.188. [10******] Server A 125. [00011011].*.* Server A 125. [000111**].*.* Server A 125. [001000**].*.* Server A 125.[00100100].*.* Server A 125.[00100101].255.0 Server B 125.[00100101]. 255.* Server A 125.[00100101]. *.* Server B 125. [001*****].*.* Server B 126. 1.*.* Server B 126. 2. [00******].* Server B 126. 2. [010*****].* Server B 126. 2. [011000**].* Server B 126. 2. 100.[0010****] Server B 126. 2. 100.[00110001] Server B 126. 2. 100.[00110010] ActionEndStart Server A125.37.255.0125.26.188. 56 Server B126.2.100.50125.37.255.1 36 Flow table ActionPattern Server A 125.[00100100].255.0 Server B 125.[00100100]. 255.* Server A 125.[00100100]. *.*

7. Our Ranges Implementation 2 entries per range Atomic (create, delete, split, merge) with O(1) control message complexity. merge split

8. [Panigrahy&Sharma2003] TCAM range implementation TCAM Query Compare

9. Adapting [PS2003] to OpenFlow Even Comparisons are Flow-Table based! Flow Table Query Flow Table Query Compare Flow Table based comparisons

10. OpenFlow based Comparison patterns 0*******1******* 0******* *0*******1****** *0******............ ******** Result m>q m<q m>q m<q...... m=q qm Packet header

11. Issue 2: Cross Entrance Consistency

12. Per-Flow Consistency [Reitblatt, Foster, Rexford, Schlesinger, Walker 2012] Internet replicas client’s IPs …

13. Internet replicas client’s IPs Change in weights  Change in ranges … ActionEndStart Server 2125.37.255.0125.26.188. 56 Server 3126.2.100.50125.37.255.1 36 But existing flow shouldn’t change Per-Flow Consistency [Wang, Butnariu, Rexford, 2011]

14. Per-Flow Consistency solution [Wang et.al.] Internet replicas client’s IPs … Controller ActionEndStart Server 2125.37.255.0125.26.188. 56 Server 3126.2.100.50125.37.255.1 36 1. Send flows in affected sub range to controller

15. Internet replicas client’s IPs … Controller ActionEndStart Server 2125.37.1.1 Server 2125.37.255.0125.26.188. 56 Server 3126.2.100.50125.37.255.1 36 2. Add specific rules for existing flows Per-Flow Consistency solution [Wang et.al.]

16. Internet replicas client’s IPs … Richer OpenFlow interface (e.g. DevoFlow) can solve this locally in the switch and save control communication. Richer OpenFlow interface (e.g. DevoFlow) can solve this locally in the switch and save control communication. Controller DevoFlow Per-Flow Consistency solution [Wang et.al.]

17. DevoFlow Src IPDst IPAction 10.0.0.210.*.*.*Forward port 3 Src IPDst IPAction Devo Rules Standard Rules Src IPDst IP 10.0.0.210.0.1.2 Packet 10.0.0.210.0.1.2Forward port 3 [Mogul, Tourrilhes, Yalagandula, Sharma, Curtis, Banerjee 2010]

18. DevoFlow Src IPDst IPAction 10.0.0.210.*.*.*Forward port 5 Src IPDst IPAction 10.0.0.210.0.1.2Forward port 3 Devo Rules Standard Rules Src IPDst IP 10.0.0.210.7.1.5 Packet 10.0.0.210.7.1.5Forward port 5

19. Internet replicas client’s IPs … Richer OpenFlow interface (e.g. DevoFlow) can solve this locally in the switch and save control communication. Richer OpenFlow interface (e.g. DevoFlow) can solve this locally in the switch and save control communication. Controller DevoFlow Per-Flow Consistency solution [Wang et.al.]

20. Cross-Entrance Consistency replicas … client’s IPs Internet X Controller SDN Network Local solution is not possible We must sync between entrances Local solution is not possible We must sync between entrances

21. Implementing Cross-Entrance Consistency replicas … client’s IPs Internet Controller DevoFlow + SYN match DevoFlow + SYN match Richer OpenFlow interface (e.g. DevoFlow and SYN matching) can reduce control communication. DevoFlow + SYN match DevoFlow + SYN match

22. Consistency Costs Consistency model Special features Control trafficFlow delay and buffering Per flow NoHigh Devoflow None Cross entrance NoHigh Devoflow Low: O(flows*entrances) Low (only SYNs)

23. summary Efficient Ranges implementation Multi-entrance consistency

24. Questions ?