Packet-Level Analytics in Software without Compromises HotCloud 18, - PowerPoint PPT Presentation

Packet-Level Analytics in Software without Compromises HotCloud ’18, July 9th, 2018, Boston, MA Oliver Michel John Sonchack Eric Keller Jonathan M. Smith

Network monitoring is important ■ Security issues Analytics Platform ■ Performance issues Switch + Telemetry ■ Equipment failure ■ Misconfiguration Packet-Level Analytics in Software without Compromises — Oliver Michel 2

Challenging environment ■ more traffic ■ more threats ■ encrypted traffic Total Ransomware Samples Fraction of encrypted HTTP traffic in Google Chrome 15 100 Collected Samples [M] 82 12.1 75 10.8 10 % encrypted 67 9.5 8.9 8.4 50 54 7.8 47 6 5 25 4.4 0 0 Q4 2015 Q12016 Q2 2016 Q3 2016 Q4 2016 Q1 2017 Q2 2017 Q3 2017 Jun 6 2015 Jun 4 2016 Jun 3 2017 Jun 2 2018 [Google Transparency Report 2018] [McAfee Labs Thread Report Dec. 2017] Packet-Level Analytics in Software without Compromises — Oliver Michel 3

Existing systems make compromises loss of information collector PFE analytics 2 aggregation filtering sampling 6 4 filter() groupby() zip() loss of capability Packet-Level Analytics in Software without Compromises — Oliver Michel 4

Programmable Forwarding Engines ■ Programmable Forwarding Engines ■ Marple [SIGCOMM 2017] ■ *flow [ATC 2018] High-Performance Network ? Telemetry ~ 131 M packet records/s *flow technology Packet-Level Analytics in Software without Compromises — Oliver Michel 5

The ideal network analytics system Is it possible to perform packet-level analytics on cloud-scale infrastructures without compromises? ■ per-packet records ■ x86 / general purpose programming language ■ ~5M pps per core Packet-Level Analytics in Software without Compromises — Oliver Michel 6

Leveraging parallel architectures source sink parallel operators Packet-Level Analytics in Software without Compromises — Oliver Michel 7

Leveraging parallel architectures Backend NIC (e.g., time series DB) aggregation input stage stage processing stages Packet-Level Analytics in Software without Compromises — Oliver Michel 8

Characteristics of packet record workloads Can we use properties of packet analytics workloads to our advantage? ■ Network attached input ■ Partitionability/aggregation ■ High rates, small, well-formed records Packet-Level Analytics in Software without Compromises — Oliver Michel 9

Network attached input analytics queue NIC DMA pipeline analytics Switch/PFE 40G/100G NIC queue NIC DMA pipeline analytics queue NIC DMA pipeline Packet-Level Analytics in Software without Compromises — Oliver Michel 10

Many small records 16 ■ Array vs. linked list 12 throughput [M records/s] ■ Lock-free design 8 ■ Wait-free design 4 ■ Zero-copy operations 0 lock-based, array lock-free, linked list lock-free,array Packet-Level Analytics in Software without Compromises — Oliver Michel 11

Programming Abstraction source sink port port ring buffer 1 int main(int argc, char** argv) 2 { jetstream::app app; 3 4 auto source = app.add_stage<source>(1, “enp6s0f0”); 5 auto sink = app.add_stage<sink>(1, std::cout); app.connect<jetstream::pkt_t>(source, sink); 6 7 app(); 8 return 0; 9 } Packet-Level Analytics in Software without Compromises — Oliver Michel 12

Performance 1 12 throughput [M packets/s] 2 10 8 3 6 4 4 source sink 2 passthrough packets per source 0 5 1 2 3 4 5 6 intermediate processors 6 parallel operators Packet-Level Analytics in Software without Compromises — Oliver Michel 13

Performance ~88 Gb/s — 91M p/s jetstream 32 cores ~352 Gb/s ■ Facebook web cluster: ~ 91M egress pps ■ ~32 cores for basic packet-level insight ■ 176 web servers — 1 analytics server: ~0.5% of cluster capacity [Arjun Roy, Hongyi Zeng, Jasmeet Bagga, George Porter, and Alex C. Snoeren. 2015. Inside the Social Network's (Datacenter) Network. SIGCOMM Comput. Commun. Rev. 45, 4 (August 2015), 123-137] ] Packet-Level Analytics in Software without Compromises — Oliver Michel 14

Conclusion / Discussion Is it possible to perform packet-level analytics on cloud-scale infrastructures without compromises? high-performance, software jetstream network analytics platform Packet-Level Analytics in Software without Compromises — Oliver Michel 15

Q&A / D ISCUSSION Oliver Michel oliver.michel@colorado.edu http://nsr.colorado.edu/oliver

packet-level flow-level The right approach for network monitoring and analytics? software hardware What data do we need for monitoring/debugging? Packet-Level Analytics in Software without Compromises — Oliver Michel 17

P ANEL O PENING S LIDE

Packet-Level Analytics in Software without Compromises Oliver Michel, John Sonchack, Eric Keller, Jonathan M. Smith University of Colorado Boulder, University of Pennsylvania programmable forwarding engines encrypted traffic complex applications behavioral analysis packet level record generation software processing source sink parallel operators

B ACKUP S LIDES

[Apache Flink] [StreamBox Miao ‘18] 21 Packet-Level Analytics without Compromises — Oliver Michel

Programming abstraction Processor definition 1 class source : public jetstream::proc { 2 […] 3 }; 1 explicit source(const std::string& iface_name_) : proc() { 2 add_out_port<jetstream::pkt_t>(0); 3 […] 4 } 1 jetstream::signal operator()() override { 2 out_port<pkt_t>(0)->enqueue(read_from_nic(_pkt), jetstream::signal::continue); 3 return jetstream::signal::continue; 4 } 22 Packet-Level Analytics without Compromises — Oliver Michel

Jetstream architecture NUMA awareness pipeline 1 → CPU socket 1 Backend NIC (e.g., time series DB) pipeline 2 → CPU socket 2 23 Packet-Level Analytics without Compromises — Oliver Michel

Stream Processing ip_dst % 2 == 0 TCP TCP Packet Packet Packet Packet Filter Parallelize only TCP group by IP Destination ip_dst % 2 == 1 Bin Filter Alert > n Bytes per 10 sec by time (e.g,, 10sec) 24 Packet-Level Analytics without Compromises — Oliver Michel

Reducing copy operations Packet Bu ff er Pointer Passing queue<pkt*> queue<pkt*> 25 Packet-Level Analytics without Compromises — Oliver Michel

Reducing copy operations 1 packet p; 2 p.ip_proto = 6; 3 q.enqueue(p); pointer directly Pointer into queue Passing queue<pkt> 1 auto p = q.enqueue(); 2 p->ip_proto = 6; 26 Packet-Level Analytics without Compromises — Oliver Michel

Technologies • Programmable switches and PISA: Protocol Independent Switch Architecture • Reconfigurable match-action tables in hardware • multiple stages with TCAM/ALU pair, fixed processing time, guarantees line rate 27