Co Conc ncer erto to: Cooperative Network-Wide Telemetry with - PowerPoint PPT Presentation

Co Conc ncer erto to: Cooperative Network-Wide Telemetry with Controllable Error Rate Yiran Li Kevin Gao Xin Jin Wei Xu

Net etwork rk Tel elem emet etry ry Provide ides s Us Usef eful ul Status tus Knowle wledge dge Query Interface DDoS Det. New TCP Port Scan Expressive & High Fidelity Operators Telemetry System Core Operates Packets Switch Config Telemetry Tuples of Whole Network in Real-Time Switch 2

Exe xecuti uting ng Lo Location ion: : Stream eam Proces essor sor vs. s. PISA A Swit itch ch Task Assignment DDoS Det. SP vs. PISA Switch Executing at SP: √ General Processing × Scalability Problem Executing at PISA Switch √ Real-Time Processing × Limited Stages & Memory Stage 1 Stage 2 Deparser Parser Traffic Traffic Mem. ALU Mem. ALU Protocol Independent Switch Architecture Network Telemetry System 3

Di Differe rent nt Swi witche ches s Pla lay y Di Differe rent nt Role les Telemetry Systems Big Data Frameworks Driver Program Query Cluster Manager Core SP Dynamically Assign Statically Assign to vs. to Available Executor Specific Switch S 3 Worker Worker Worker S 1 Executor Executor Executor Executor Executor Executor Executor Executor Executor Executor Executor Executor S 2 Switches with Different Roles Identical Workers, Executors 4

Usi sing g Swi witche ches s In Inde depe pendent dently ly Is Is In Insu suffic fficient ient Splitting Query Between SP 4 .map ((_, dip ) => (dip ,1)) & Edge Switch Dynamically 5 .scan (( dip ,_) => dip , sum ) 6 .filter (( dip , count ) => count ==T) 7 .map (( dip , count ) => dip ) 1 packetStream 2 .map (p => (p.ip.sip ,p.ip. dip )) SP Unused 3 .distinct (( sip , dip ) => (sip , dip )) 4 .map ((_, dip ) => (dip ,1)) SRC DST 5 .scan (( dip ,_) => dip , sum ) Edge 6 .filter (( dip , count ) => count ==T) SRC 7 .map (( dip , count ) => dip ) S 3 Edge DDoS Detection Query Unused S 1 1 packetStream 2 .map (p => (p.ip.sip ,p.ip. dip )) S 2 3 .distinct (( sip , dip ) => (sip , dip )) 5

Usi sing g Swi witche ches s In Inde depe pendent dently ly Is Is In Insu suffic fficient ient (Cont.) t.) Static Splitting & Using 4 .map ((_, dip ) => (dip ,1)) Switches Independently 5 .scan (( dip ,_) => dip , sum ) 6 .filter (( dip , count ) => count ==T) 7 .map (( dip , count ) => dip ) Wasted 1 packetStream Duplicated 2 .map (p => (p.ip.sip ,p.ip. dip )) SP 3 .distinct (( sip , dip ) => (sip , dip )) 4 .map ((_, dip ) => (dip ,1)) SRC DST 5 .scan (( dip ,_) => dip , sum ) Edge Unused 6 .filter (( dip , count ) => count ==T) SRC 7 .map (( dip , count ) => dip ) S 3 Edge DDoS Detection Query S 1 S 2 1 packetStream 2 .map (p => (p.ip.sip ,p.ip. dip )) 3 .distinct (( sip , dip ) => (sip , dip )) 6

Concert erto: o: Cooper erative ative Net etwork rk-Wide Wide Te Telem emet etry ry • Challenge • Splitting queries among switches while meeting resource & network constraints • Cooperative query execution model Q Q Q Query • Splitting query to multiple PISA switches Result 1 2 3 • Each switch processes tuples locally Stream SP Concerto Core • Various operations on different switches Processor Config • Best-effort tuple processing Intermediate Tuples Switch Config • Automatic query placement • Analyzing query restrictions from AST • Formulating query placement as MIP Switch • Result • Reduce the stream processor’s workload by up to 19 × • Achieve 10 4 × lower error rate with the same workload 7

Coope perativ ative Query y Executi ution on Mo Mode del 6 .filter (( dip , count ) => count ==T) 7 .map (( dip , count ) => dip ) 1 packetStream 2 .map (p => (p.ip.sip ,p.ip. dip )) 5→7 4→7 3 .distinct (( sip , dip ) => (sip , dip )) Phase 7 Phase 4 S 3 SP 1 →3 5 .scan (( dip ,_) => dip , sum ) 6 .filter (( dip , count ) => count ==T) S 1 7 .map (( dip , count ) => dip ) S 2 3→5 4 .map ((_, dip ) => (dip ,1)) 5 .scan (( dip ,_) => dip , sum ) 8

Query y Executi ution on on Swi witche hes Stage Like Bloom Filter Subquery 1: 05:scan Subquery 2: 06:filter 07:map Mem. ALU S 1 05 06 07 07 PHV PHV Pkt Pkt 04 05 05 05 05 S 2 Stage 1 Stage 2 Stage 3 Stage 4 Parser Deparser Four-Stage PISA Switch Only Based on Phase 9

Concerto rto Puts s Mo More Op Operati tions ons on S Swi witche ches 1 packetStream 2333 4 - - - 5556 f 1 : S 1 → S 6 2 .map (p => (p.ip.sip ,p.ip. dip )) 3333 7 3 .distinct (( sip , dip ) => (sip , dip )) S 1 S 4 S 6 Result 4 .map ((_, dip ) => (dip ,1)) Tuples f 2 : S 2 → S 6 4 - - - 2 - - - 555 6 5 .scan (( dip ,_) => dip , sum ) S 3 Stream f 3 : S 2 → S 7 6 .filter (( dip , count ) => count ==T) Processor 7 .map (( dip , count ) => dip ) S 5 S 2 S 7 • Switch hardware # Tuples # Stages Flow t1, t2 t3, t4 t5 t6, t7 d3 d5 • 4 stages f1 442628 50034 1033 25 3 3 • 0.5 Mb of registers at each stage f2 1383594 113584 1739 36 4 3 • Results f3 307941 8874 2194 25 3 3 f1+f2 1826222 163618 2772 61 5 3 • Stateless filtering: 2.1 × 10 6 f2+f3 1691535 122458 3933 61 4 4 • Independent stateful: 1.4 × 10 6 f1+f2+f3 2134163 172492 4966 86 5 4 • Concerto: 86 10

Eval aluat uatio ion n Setup up • Questions: workload reduction, error rate guarantee, scalability • Topology ATT North America Topology # Sites # Links Claranet 15 018 ATT North America 25 056 Cesnet-10 52 063 OTEGlobe 93 103 • CAIDA trace: captured at a backbone ISP link from New York to San Paulo • Compared systems • Stateless : Everflow, DREAM • EdgeAll : Sonata • AnyAggre : OpenSketch, UnivMon, Marple • Metric: # tuples to the stream processor (same as Sonata) 11

Concerto Reduces SP’s Workload on Various Queries Stateless EdgeAll AnyAggre Concerto 10 8 10 6 #Tuples 10 4 10 2 Log- Better SSpreader New TCP Port Scan DDoS In. Flows SSH Brute Slowloris Scaled Single-Query Performance on Various Queries 12

Concerto rto Ac Achie ieve ves s Mu Much Lowe wer Error Rate Stateless EdgeAll AnyAggre Concerto 10 8 10 7 10 7 #Tuples 10 6 10 6 10 4 10 5 10 5 10 4 10 4 10 1 10 -1 10 -3 10 1 10 0 10 -5 10 -1 Error Rate (%) Error Rate (%) One Query Four Queries Error Rate Requirement 13

Concerto rto Scal ales s Well ll Stateless EdgeAll AnyAggre Concerto Similar Similar Similar Normalized #Tuples 10 4 10 4 10 3 10 2 10 2 10 0 10 0 10 0 Different Different One Query Two Queries Four Queries Normalized To Concerto Normalized Workloads on Various Topologies 14

Conclusi lusion on • We propose a cooperative query execution model • Mimics network routing, each switch processes tuples locally • Independent of the underlying routing method • Applies to arbitrary topology • We provide a method to automatically compile queries to PISA switches • Analyzes the query placement requirement from AST • Formulates and optimizes query placement on switches using MIP • We show that the cooperative query execution of Concerto is effective • Reduces the stream processor’s workload by as much as 19 times • Achieves an error rate of 10 4 times lower than state-of-the-art systems 15

Th Thanks! anks! Q& Q&A