1. CEDAR Counter-Estimation Decoupling for Approximate Rates Erez Tsidon (Technion, Israel) Joint work with Iddo Hanniel and Isaac Keslassy ( Technion ) 1

2. Network Flow Counters Usage  Network management applications require per-flow counters, for example:  Congestion Control  Detection of Denial of Service Attacks  Detection of Traffic Anomalies  Counter types:  Packet counting  Byte counting  Rate measurement 2

3. Switch Example  40MB memory  32nsec for single counter access DRAM is too slow SRAM is too expensive 3 SWITCH 10 6 flows Total Packet Count Total Byte Count Packet Rate Count event A Count event B per-flow counters 64-bit width Min packet size = 40B Link Rate 10Gbps

4. Suggested Solutions  Hybrid SRAM-DRAM counters [Shah, Iyer, Prabhakar and McKeown ’02]  Cannot support fast reading  Counter Braids – compress counters into small SRAM [Y. Lu et al ’08]  Cannot decompress in real time  Heavy Hitters – store only high counters [Estan and Varghese ’03]  No records of small counter values 4

5. Counter Estimation Solutions  Intuitively we want counters to be as precise as possible, unbiased whenever possible, and scalable  SAC – R. Stanojevic, “Small Active Counters”, 2007 SAC  Exponent-Magnitude representation  Unbiased estimation  Scalable Restricted to specific representation which prevents error optimization  DISCO – C. Hu et al, “DISCO: Memory Efficient and Accurate Flow Statistics for Network Measurement”, 2010 DISCO  Convex conversion function that reduces increment values  Unbiased estimation Restricted to a close function representation. No scaling 5

6. Our Contributions  CEDAR – decoupling counters from estimators  Optimal estimators for the min-max relative error  Dynamic up-scale algorithm  Exponential-averaged rate estimation 6

7. Counter-Estimators Decoupling 7 995,784 1.2 1,000,000 1.2 Counter estimates F N-1 F N-2 F1F1 F0F0 1,000,000 995,784 1.2 0 p(L-2) p(1) p(L-1) p(1) A L-1 A L-2 A1A1 A0A0 3.7 A2A2 Flow pointers Shared estimators log 2 L q F N-1 F N-2 F1F1 F0F0

8. CEDAR Structure  N flows  L estimators  Flow array:  Estimation array:  Estimator differences: 8 1,000,000 995,784 1.2 0 p(L-2) p(1) p(L-1) p(1) A L-1 A L-2 A1A1 A0A0 3.7 A2A2 Flow pointers Shared estimators log 2 L q F N-1 F N-2 F1F1 F0F0

9. 0 1 44 CEDAR Increment Algorithm 9 4 1 A3A3 A2A2 A1A1 0 A0A0 211 132 54.7 11 A7A7 A6A6 A5A5 A4A4 9 4 1 0 211 132 54.7 11 9 4 1 0 211 132 54.7 11 9 4 1 0 211 132 54.7 11 time p=1 p=1/3 p=1/5 t=0t=1t=2t=3 9 Upon packet arrival: with probability

10. Performance Measures  Traffic Amount –  - a random variable that represents the number of real counter increments in order for to hit estimator  Relative error – Coefficient of Variation: 10

11. Min-Max Relative Error  Problem: assuming L and A L-1 are given, find an estimation array that minimizes the guaranteed relative error δ such that  Solution: equal relative error  Estimation values 11

12. Equal Relative Error Example 12 Estimation Values Relative Error δ δ A1A1 A2A2 A3A3 A1A1 A2A2 A3A3 δ A1A1 A2A2 A3A3

13. Capacity Region of Static CEDAR 13 Example: 10-bit counters Max value 10^6  min-max relative error 8%

14. 4.5 1 Up-Scale Procedure 3 1 A3A3 A2A2 A1A1 0 A0A0 211 132 54 11 A7A7 A6A6 A5A5 A4A4 24 5 2 0 517 314 156 93 54 11 p=0.5 0 p=0.43 =(54-24)/(93-24) 93 14 A’A’’ upscale threshold Initial relative error δ 0 Increase the relative error δ 0 + δ step

15. CEDAR Unbiasedness 15

16. CEDAR Equal Error 16

17. CEDAR Vs. SAC & DISCO 12-bit 17 4096 estimators

18. CEDAR Vs. SAC & DISCO 8-bit 18 256 estimators

19. CEDAR Error Adjustment 12-bit 19

20. CEDAR Implementation on FPGA 20 5.4 Gbps 12K gates

21. Exponential-Average Rate Estimation A3A3 A2A2 A1A1 A0A0 A7A7 A6A6 A5A5 A4A4 time x0.98 down-scale 33.3 16.6 0 99.9 83.3 66.6 49.9 119.5 51 34 17 0 122 102 85 68 0 P = 0.02x100/(85-68) Incoming packet 51 34 17 122 102 85 68 t0t0 t 0 + 1t 0 + 2 x0.98 down-scale 32.6 16.3 0 97.9 81.6 65.3 48.9 117.1 68 8583.381.683.3 21

22. Exponential-Average Rate Estimation A3A3 A2A2 A1A1 A0A0 A7A7 A6A6 A5A5 A4A4 time t 0 + 10t 0 + 2 32.6 16.3 0 97.9 81.6 65.3 48.9 117.1 41.6 27.7 0 99.6 83.3 69.4 55.5 13.8 up-scaling 0 51 34 17 122 102 85 68 P = (85-69.4)/(85-68) After 8 more down-scaling cycles 81.669.4 68 99.6 22

23. EXP-CEDAR 7-bit 23  Real exp-average with 64 bits  For 10^(-2) precision – 14 bits are required

24. EXP-CEDAR 9-bit 24

25. CEDAR Summary  Decoupling - flexible estimators  Unbiased and scalable estimation  Attains the min-max relative error  FPGA supports link rate of 5.4Gbps and may increase to tens of Gbps on ASIC  Exponential-average rate estimation 25

26. Thank you. 26