Ranges & Cross-Entrance Consistency with OpenFlow

1. Ranges & Cross-Entrance Consistency with OpenFlow Liron Schiff (TAU) Joint work with Yehuda Afek (TAU) AnatBremler-Barr (IDC) Israel Networking Day 2014

2. Issue 1: Ranges replicas Internet Source IP Address … Firewalls Load Balancers DDoS mitigation Forwarding …….

3. Issue 2: Cross-Entrance Consistency replicas SDN Network Internet … client’s IPs

4. Contributions • Ranges: Efficient implementation w/ OpenFlow • 2entries per range; total, 2n vs. Previously n∙wtable entries (n number of intervals, w field size, usually 16 or 32) • Consistent & Atomic ranges update • Per packet, and per flow consistency • Cross entrance consistency (with ranges)

5. Ranges Current Solution: Expansion 2w – 4 entries per range

6. Current Solution: Range Update Flow table • Change affects several entries • Need atomicity (while traffic passes thru) • Packet buffering, or duplicating and switching tables 36 36

7. Our Ranges Implementation • 2 entries per range • Atomic (create, delete, split, merge) with O(1) control message complexity. split merge

8. [Panigrahy&Sharma2003] TCAM range implementation TCAM Query Compare Compare TCAM Query

9. Adapting [PS2003] to OpenFlow • Even Comparisons are Flow-Table based! Flow Table Query Flow Table Query Compare Compare Flow Table based comparisons

10. OpenFlow based Comparison Packet header m q

11. Issue 2: Cross Entrance Consistency

12. Per-Flow Consistency[Reitblatt, Foster, Rexford, Schlesinger, Walker 2012] replicas Internet … client’s IPs

13. Per-Flow Consistency[Wang, Butnariu, Rexford, 2011] Change in weights  Change in ranges replicas 36 Internet 36 But existing flow shouldn’t change … client’s IPs

14. Per-Flow Consistency solution [Wang et.al.] 1. Send flows in affected sub range to controller replicas 36 Internet 36 Controller … client’s IPs

15. Per-Flow Consistency solution [Wang et.al.] 2. Add specific rules for existing flows replicas 36 Internet 36 Controller … client’s IPs

16. Per-Flow Consistency solution [Wang et.al.] Richer OpenFlow interface (e.g. DevoFlow) can solve this locally in the switch and save control communication. replicas Internet DevoFlow Controller … client’s IPs

17. DevoFlow [Mogul, Tourrilhes, Yalagandula, Sharma, Curtis, Banerjee 2010] Standard Rules Packet Devo Rules

18. DevoFlow Standard Rules Packet Devo Rules

19. Per-Flow Consistency solution [Wang et.al.] Richer OpenFlow interface (e.g. DevoFlow) can solve this locally in the switch and save control communication. replicas Internet DevoFlow Controller … client’s IPs

20. Cross-Entrance Consistency Local solution is not possible We must sync between entrances replicas SDN Network X Internet Controller ? … client’s IPs

21. Implementing Cross-Entrance Consistency Richer OpenFlow interface (e.g. DevoFlow and SYN matching) can reduce control communication. replicas Internet DevoFlow + SYN match Controller DevoFlow + SYN match … client’s IPs

22. summary • Efficient Ranges implementation • Multi-entrance consistency

23. Questions ?