With the advancement of SDN and NFV techniques a series of work was proposed: OpenSketch, DREAM, FlowRadar, Trumpet Hybrid solution that balances the tradeoff between FCAP (higher accuracy) and SMON (less memory) Alternative data structure to Ring Buffer that would consume less memory Achieve a design of integration that has the minimal forwarding-monitoring function interference, optimal code sharing and efficient CPU/Memory resource usage

1. Instrumenting Open vSwitch with Monitoring
Capabilities: Designs and Challenges
Zili Zha1
, An Wang1
, Yang Guo2
, Doug Montgomery2
, Songqing Chen1
Presented by:
Ajay Kharat(2019H1030011G)
BITS Pilani

2. • Network measurement is essential for various management tasks such as
network traffic engineering, anomaly detection, QoS.
• Existing measurement frameworks
- Inflexible and non-programmable
• Urgent needs of flexible and programmable measurement frameworks
Challenges:
I. Minimal implementation complexity
II. Trade-offs between resource consumption and
measurement accuracy
III. Minimal interferences with the forwarding path
Motivation

3. Problem Statement

4. UMON Architecture
Challenge I:
Minimal
implementation
complexity
Monitoring API’s
[DstIP=A, Output(0)]
[DstIP=B, Output(1)]
Install Flow Rules
user space
kernel space
Upcall
Fine-grained Kernel Flow Cache
[SrcIP=C, DstIP=A, DstPort=80, Output(0)]
[SrcIP=C, DstIP=A, DstPort=22, Output(0)]
[SrcIP=D, DstIP=B, DstPort=80, Output(1)]
[SrcIP=D, DstIP=B, DstPort=22, Output(1)]
Combining forwarding rule with
monitoring rule.
[SrcIP=C,
DstPort=80, count]
[SrcIP=D,
DstPort=80, count]
[DstPort=80,
Counts(‘SrcIP’)]
Kernel Flow Cache gets bloated during peak traffic
+
Handlers and Revalidators gets heavily loaded

5. Approach and Solution

6. On-Path FCAP/SMON
Architecture
Custo
m n-
tuple
table
[DstPort=80]
Challenge II:
Resource-Accuracy
Trade-offs
n-tuple flow stats
FCAP
f1
f2
Flow XOR-ed n-tuple + stats
SMON iBLT

7. Challenge III:
Minimal interferences
with Forwarding path
sample_collector
thread
Off-Path FCAP/SMON
Architecture

8. Evaluation of the Solution

9. CPU Utilisation
• Testbed Setup
- Intel Xeon 4-Core 3.20 GHz CPU;
4GB memory
- Host and OVS connected with 10 Gbps
cables
- Ryu SDN Controller
• Total CPU utilisation of all
related threads
- 2 handlers + 2 revalidators
- collector thread in the user space
- Custom sample_collector thread in the
kernel module
CPU Overhead (packet rate = 160 Kpps)
CPU Overhead (packet rate = 80 Kpps)
UMON incurs highest
CPU utilisation
FCAP incurs less CPU
overhead than SMON

10. Memory Consumption and Monitoring Accuracy
• Off-path introduces less forwarding delay, same measurement accuracy with higher
memory.
• SMON incurs higher latency than FCAP with acceptable measurement accuracy loss.
Comparison of different monitoring designs
Memory usage (MB) (packet rate = 160 Kpps)
SMON is the most
memory efficient
while UMON incurs
the highest memory
consumption

11. Switching Throughput and Latency
Throughput Latency
UMON achieves lowest
throughput and highest latency
Off-path achieves higher throughput
and lower latency than on-path designs

12. • UMON: least implementation efforts, highest CPU overhead, highest
memory consumption
• Off-path designs: outperform on-path designs in terms of switching
performance, higher memory usage
• Hash table: more efficient than sketch, lower computational cost.
Overall Comparison and Insights
Comparison of different frameworks

13. Related Work
• Traditional hardware based solutions to collect the IP network traffic used tools such
as:
- Netflow, Sflow, IPFIX
• With the advancement of SDN and NFV techniques a series of work was proposed:
- OpenSketch, DREAM, FlowRadar, Trumpet
Drawbacks:
Expensive to deploy
Do not provide enough programmability for network management task
Future Scope
• Hybrid solution that balances the tradeoff between FCAP (higher accuracy) and
SMON (less memory)
• Alternative data structure to Ring Buffer that would consume less memory
• Achieve a design of integration that has the minimal forwarding-monitoring function
interference, optimal code sharing and efficient CPU/Memory resource usage