The document discusses an open networking approach called Openet that provides programmability of network devices. Openet allows for the deployment of active services on commercial network hardware through a programmable platform. It explores using the Alteon 780 series switch as a research platform, which provides L2-L7 filtering and powerful computation through integrated service delivery systems. The goal is to embed intelligence and computation within the network to enable new applications and services.

1. Open Networking
through
Programmability
Tal Lavian
OOppeenneett::
TTaall LLaavviiaann
ttllaavviiaann@@iieeeeee..oorrgg
NNoorrtteell NNeettwwoorrkk,, AAddvvaanncceedd TTeecchhnnoollooggyy LLaabb

2. 3/6/2002 2
Openet DARPA UC Berkeley
Agenda
 Two Evolutions: computer vs network
 Openet: open networking approach
 DARPA-Funded Project: Openet/Alteon &
Research Platform
 EE CS Collaboration
 Openet Features and Applications
 Summary

3. Think of computer evolution …
3/6/2002 3
IBM CDC Digital Amdel
Openet DARPA UC Berkeley
Applications
OSs
Peripherals
Hardware
1980s - Vertical Industry 2000s - Horizontal Industry

4. 3/6/2002 4
What’s network evolution?
Cisco Nortel Juniper Lucent
The inflection point is quickly approaching …
Openet DARPA UC Berkeley
Network &
Mgmt services
Embedded
OS
System
ASICs
“2000s Vertical Network Industry Horizontal Network Industry

5. 3/6/2002 5
Why Open Networking?
 Open network boxes to public
• Current network devices are
close systems
 Intelligence to network nodes
because
• Internet infrastructure evolves
slow
• Customers can not add new
services
Openet DARPA UC Berkeley
 Better use of network
resources
• Abundant bandwidth
• Diversified clients’ needs
Move Turing Machine onto
Device
Add local intelligence to network devices
while (true)
doLocalProcessingOnDevice();

6. 3/6/2002 6
Challenges and Solution
 Commercial network devices have
• Ever more use of hardware acceleration
– Static and well-defined protocols and services
• Little flexibility to introduce users’ intelligence
– Allowing configuration rather than value addition
 Active Networks requires
• Open boxes to users
• Networking programmability
Openet DARPA UC Berkeley
 Our solution
• Openet
– A programmable networking platform across devices
• Active Services through Openet
• Wire-speed data plane, powerful computation in the
control plane

7. 3/6/2002 7
The Openet Approach
 Open networking through programming
• A Service-enabled networking platform
• Intelligence to commercial network devices
– Network control and management
– Packet forwarding and processing
• Not impeding network performance and reliability
Openet DARPA UC Berkeley
– Forwarding
– Security
 Enabling service creation and deployment
• Value-added services across network elements
• Dynamic and downloadable
 Standards and Partners
• IEEE, IETF, Active Networks and FAIN
• Columbia U., UC Berkeley
• MITRE, TASC, and CSIRO

8. 3/6/2002 8
System Services
CPU System
Openet Architecture
Control Plane ORE
Switching Fabric
Forwarding
Rules
Forwarding
Rules
Openet DARPA UC Berkeley
Data Plane
(Wire Speed Forwarding)
Applications
Traffic Packets
Monitor status New rules
Forwarding
Processor
Statistics
&Monitors
Forwarding . . .
Processor
Statistics
&Monitors
Forwarding
Rules
Forwarding
Processor
Statistics
&Monitors

9. Active Nets Technology Transfer
through High-Performance Network
Devices
 Exploring new commercial network
hardware as a research platform
3/6/2002 9
DARPA-Funded Project
• L2-L7 filtering
• Fast content filtering and redirection
• Strong and extensible CPU capability
• Secure partitioning hardware and software
 Server and network collapse
• Getting computation inside the network
• Explore new ideas
Openet DARPA UC Berkeley

10. 3/6/2002 10
Introducing the Alteon 780 Series
Large-Scale Data Center Content Switch/Router
 Alteon Webworking integrated with
Nortel switching technology
• Distributed Alteon WebICs
• Alteon WebOS services
• Layers 2-7 switching
• 128G switch capacity
• 300+ FE; 60 GbE
• Data center class redundancy
• Future:
– iSD and PCD integration
– ATM and PoS connectivity
– NEBS-3 compliance platform
Openet DARPA UC Berkeley

11. 3/6/2002 11
iSD Architecture
application code
SSI
• Clustering
• Management
• Registry, CLI, …
Operating System (Alteon Embedded Linux
Openet DARPA UC Berkeley
Or
RTIK – Real time Internet Kernel)
iSD Hardware
Switch
Interface:
iSD
Web Switch
NAAP

12. Dynamic L2-L7 Filtering
JFWD 5-tuple Filtering
3/6/2002 12
L2-L7 Filtering Capability
 Source Address
 Source Port
 Destination
Openet DARPA UC Berkeley
Address
 Destination Port
 Protocol
 Diffserve Code
Points
 Content Filtering
 Cookies Filtering
 Divert the packet to
the control plane
 Don't forward the
packet
 Change DSCP field
 Set VLAN priority
 Adjust priority queue
 Modify session table
 Parsing request header
 Parsing application
contents

13. Alteon = Control + Processing + Storage + Programmable
3/6/2002 13
The value of Alteon:
Services
Alteon intercepts selected
flows and do some
intelligent processing
based on L2-L7 filtering
•An API is needed
for filtering
Users Servers
The emphasis is on interception and processing transparently.
Entities at both ends may not be aware of the existence of the Alteon in the path
Openet DARPA UC Berkeley

14. What does Alteon do that cannot be done
by another processor?
(X=Processor+1Gbyte+SWs)
 Before X can do any processing X has to do filtering
and/or redirecting the intended flows (flows in general
sense, i.e L2 – L7). Alteon does this within its
architecture.
 Some intended flows require Ln processing. X
processor has to process L2 – L(n-1) before Ln level
processing can be done. Alteon prepares up to and
including L(n-1) level processing within its
architecture.
 X processor can be an iSD or any general processor as
long as there is an Alteon API.
3/6/2002 14
Openet DARPA UC Berkeley

15. Layer 5+ processing and filtering
Layer 4 processing and filtering
Layer 3 processing and filtering
Layer 2 processing and filtering
3/6/2002 15
Alteon API – differentiates itself
from other boxes
Openet DARPA UC Berkeley
iSD or
other intelligent
processing devices
High-speed Link Layer
between Alteon Switch
and iSDs
Alteon API
Generic
Has interface functions from L2, L3, L4, and L5+
Object Oriented designed
Can be extended to include future sophisticated functionalities
Alteon
Others
API

16. How Does Application Acceleration Work ?
3/6/2002 16
Control
Tunnels
Openet DARPA UC Berkeley
Data Enters
Alteon
Web
Switch
Alteon
Linux
Appliance
(iSD)
Data Exits
Application Program
Data
Tunnel 1
Data
Tunnel 2
NAAP
Communication Interface
Return Path • Use of NAAP interface eliminates TCP overhead between
switch & server and allows large data blocks (complete
HTTP request)
• Server is removed from return data path
• Switching functions are removed from Linux application
code and transferred to switch hardware
• See notes section below for further detail

17.  Alteon: new generation of content switch
3/6/2002 17
T1: Programmable content switch
 Openet on Alteon
• L2-L7 filtering
• Fast content filtering and redirection to active services
• Enhanced closely with Alteon features
• Multiple processors and ASICs
• Programmable microcode
• L2-L4 and application filtering and processing
Openet DARPA UC Berkeley

18. Openet
Local Core
3/6/2002 18
T2: Research Platform
 iSD: powerful and extensible
computational plane
• Partitioning hardware and software resources
• Close interfaces to Alteon
• Cluster computations
 Network Research Platform
• Openet: active service enabling
• Alteon: content filtering in real-time
• iSD: integral computation inside the network
Openet DARPA UC Berkeley
iSD
L2-L7
filtering
Content
processing
Power
computing
Passport Alteon Optical

19. Accelar 1100
CrashBox5
Alteon
184
Alteon
184
Alteon 184
Alteon iSD
3/6/2002 19
Millennium Network
Firewall
10.1.1.2
10.2.2.1/24
10.2.2.1/24
10.1.1.1
Openet DARPA UC Berkeley
Alteon iSD
S D
s e t
Ba y N e tw o rk s
S D
s e t
B a y N e tw o r k s
S D
s e t
B a y N e tw o r k s
Alteon
184
Alteon 184
Alteon iSD
10.10.130.1/24
S D
s e t
B a y N e tw o r k s
S D
s e t
Ba y Ne tw o r k s
S D
s e t
Ba y Ne tw o r k s
Passport 8606 Passport 8610
Accelar 1100
Accelar 1100
Accelar 1100
Accelar 1100
Accelar 1100
10.10.100.2/24
10.10.100.1
10.10.110.2/24
10.10.110.1/24
10.10.120.2/24
10.10.120.1/24
10.10.130.2/24
10.20.200.2
10.20.210.2
10.20.200.1 10.20.210.1
MLT
OSPF Area 10.10.0.0
OSPF Area 10.20.0.0
OSPF Area 0.0.0.0
CrashBox1
CrashBox2
CrashBox3
CrashBox4
CrashBox6
1Gbps Link
1Gbps Link
Alteon
180e
Alteon Web Systems
Alteon
180e
Alteon
180e
Alteon Web Systems
Alteon
184
Alteon
180e
Alteon 184
Alteon iSD
Nortel- Berkeley Openet Project

20. 3/6/2002 20
Any interest?
Looking for a grant?
 Interested in summer internship?
• Talk with me later
Openet DARPA UC Berkeley

21. 3/6/2002 21
How Can We Collaborate?
 Corry is not far from Soda
• Are we EE+CS or EECS?
• How can we bridge CS and EE projects?
• Can we create a virtual lab? How?
 Openet and SmartNet are
supported by DARPA
Openet DARPA UC Berkeley

22. programmable networking platform
• Great Research platform to explore new ideas
• Commutation embedded within the network
• Linux development environment
 Gigabit speed data-plane with
programmability on the control-plane
 Openet-Alteon is a sophisticated
platform for developing real applications
and for introducing services on-demand
 Openet-Alteon SmartNets requires your
collaboration!
3/6/2002 22
Summary
 Openet on Alteon is a powerful
Openet DARPA UC Berkeley

23. HTTP://www.openetlab.org
3/6/2002 23
Visit us at
Thank You !
Openet DARPA UC Berkeley
Q & A

24. 3/6/2002 24
Openet DARPA UC Berkeley
Backup

25. 3/6/2002 25
Openet Features and
Applications
Openet DARPA UC Berkeley

26. Control
Data path
Download
User request
3/6/2002 26
Openet Architecture
Openet DARPA UC Berkeley
Repository
Server
ORE
Control Console (Net Mgr)
• service initiation and policies
• network configuration
• resource administration
• repository maintenance
End Apps
Switch
Router
Router
Switch
Download
codes,
policies,
configs
Control
&
Configuration
End Apps
• use of service
• request on the fly
ORE
ORE
ORE

27. 3/6/2002 27
Openet Compositions
 ORE
• Service creation and deployment
• Service lifecycle management
Openet DARPA UC Berkeley
 Services
• Every network function is a service
• Every service provides object APIs
 ODK
• Service development and encapsulation
 Management
• Service mgmt: initiation, policy and configuration
• Manager on console and Agents on nodes

28. 3/6/2002 28
Openet: a node’s view
Oplet
Service
ORE
Java Virtual Machine API Extensions
Openet DARPA UC Berkeley
Oplet
Service
Oplet
Service
Oplet
Service
Service
Hardware
Oplet is a program unit wrapping services

29. 3/6/2002 29
ORE: the Openet Core
Openet DARPA UC Berkeley
 ORE
• Object-oriented Runtime Environment
• Run customized software on network nodes
• Neutral to heterogeneous hardware
• Secure downloading, installation, and safe
execution inside JVM
• Fully implemented using Java

30. 3/6/2002 30
System Services: JFWD
 Java Forwarding
• IP forwarding and routing
– Diffserv marking
– Filtering and diverting
– Forwarding priority
– Routing
 Platform-independent APIs
• Implemented on Passport/Accelar and Linux
Openet DARPA UC Berkeley

31. 3/6/2002 31
Function Services
 Common use utility
 Public neutral APIs
 Examples
• HTTP: HTTP service
• Shell: ORE interactive shell
• Packet: packet handling (IP, TCP, UDP)
• Logger: service runtime printout
• OreServlet: Java servlet
Openet DARPA UC Berkeley

32. 3/6/2002 32
Typical Applications
Openet DARPA UC Berkeley
 JDiffserv
• Diffserv forwarding and DSCP marking on Passport 8600
 OpeCfg
• Dynamic configuration of optical port interfaces
 IP filtering
• Dynamic priority changes on Passport 1100
 JSNMP and JMIB
• SNMP/MIB access
• Passport 1100 and 8600
 Regatta: Fault recovery

33. 3/6/2002 33
Openet DARPA UC Berkeley
JDiffserv
 Goals
• DSCP marking and re-marking
• Priority forwarding or dropping
• Filtering
 Passport
• Model: 8600
• Java 2
 ORE
• version 0.4.1
• JFWD/JDiffserv service
• URL: “http://www.openetlab.org/downloads/”

34. 3/6/2002 34
JDiffserv on Passport
JDiffserv
HTTP server
Openet DARPA UC Berkeley
Linux PC
Linux PC
Passport 8600
Passport 1100B Passport 1100B
UDP UDP UDP
UDP sender
UDP receiver
Diffserv Monitor
Device Console
Linux PC
Differv-enabled
Network

35. 3/6/2002 35
JDiffserv Features
 Marking Types
• Admission marking
• condition marking (a.k.a., remarking)
Openet DARPA UC Berkeley
 Filters
• IP headers: 5-tuple
– Source address and port, destination address and port
– Protocol type
• DSField: DSCP
• Interface ports
 Traffic profile
• Average rate and bucket size
• Peak rate and bucket size
 Action
• Marking then forwarding
– 3-color marker: R/Y/G,RFC 2697
– new DSCP
• Dropping

36. 3/6/2002 36
On-the-fly configuration
Forwarding
Processor
Openet DARPA UC Berkeley
Forwarding
Processor
Packet
Policy
Filters
Dynamic Apps
Packet
Packet
Filte
r

37. • Encapsulates one or more service objects
• Contains service attributes, e.g., names
• Eases secure downloading and service installation
• Use other service oplets
• Examples
3/6/2002 37
What’s an Oplet?
 Oplet: a self-contained downloadable unit
– Active Networks services: EE
– Java Forwarding services: JFWD
– Base services: ODK
Openet DARPA UC Berkeley

38. 3/6/2002 38
How a service is deployed?
 Service design and coding
• Regular Java programming
 Service package
• Oplets by ODK
• JAR files
• Uploading to downloading servers
 ORE start at Passport
 Service activation by ORE
• Downloading, start and stop
– Startup service
– Shell service
 Service execution
Openet DARPA UC Berkeley

39. 3/6/2002 39
Dynamic Classification
Openet DARPA UC Berkeley
 Objectives
• Implement flow performance enhancement
mechanisms
• without introducing software into data
forwarding path
• Service defined packet processing in a
silicon-based forwarding engine
• packet classifier

40. 3/6/2002 40
Experimental Setup
100 Mbps
Openet DARPA UC Berkeley
Source 2
tcp_send()
100 Mbps
Destination
1. tcp_recv()
2. tcp_recv()
Source 1
tcp_send() Acclear
1100B
Routing
Switch
100 Mbps

41. 3/6/2002 41
Throughput Results
Openet DARPA UC Berkeley
100
80
60
40
20
0
0 1 2 3 4 5 6 7 8 9 10
Seconds
Mbps
Low Priority
High Priority
Start
2nd Flow
Change
Priority
End
2nd Flow