delta-net: real-time network verification using atoms · alex horn1, ali kheradmand2 and mukul r....

Alex Horn1, Ali Kheradmand2 and Mukul R. Prasad1

1 Fujitsu Labs of America2 University of Illinois at Urbana-Champaign (Internship)

Delta-net: Real-time Network

Verification Using Atoms

NSDI 2017, Boston, March 29

Context: “Network Verification”

1

Staged, or actual data plane

Network

ControlPlane

• [Khurshid et al., NSDI 2013], Veriflow• [Kazemian et al., NSDI 2013], NetPlumber• [Yang and Lam, ICNP 2013], AP Verifier• …

• [Canini et al., NSDI 2012], NICE• [Ball et al., PLDI 2014], VeriCon• [Fayaz et., NSDI 2016], BUZZ• [Stoenescu et al., SIGCOMM 2016], SymNet• [Fogel et al., NSDI 2015], Batfish• [Lopes et al., NSDI 2015], NoD in Z3• …

Goal: detect network outages before they occur

Context: “Network Verification”

2


Network

ControlPlane

• [Khurshid et al., NSDI 2013], Veriflow• [Kazemian et al., NSDI 2013], NetPlumber• [Yang and Lam, ICNP 2013], AP Verifier• …

• [Canini et al., NSDI 2012], NICE• [Ball et al., PLDI 2014], VeriCon• [Fayaz et., NSDI 2016], BUZZ• [Stoenescu et al., SIGCOMM 2016], SymNet• [Fogel et al., NSDI 2015], Batfish• [Lopes et al., NSDI 2015], NoD in Z3• …

Goal: detect network outages before they occur

Undecidable

Decidable

Big Picture of Real-time Network Verification

Properties

Data Plane Checker

Errors

+

z

z

z

Forwarding Table

Priority IP Prefix Action Next Hop

5 192.8.0.10/31 Forward 123.9.1.12

Forwarding Rule


e.g., forwarding loop

2

Taxonomy

4

Real-time Network

Verification

Incremental Network

Verification

Packet Equivalence

Classes

[Khurshid et al., NSDI 2013][Khurshid et al., NSDI 2013][Kazemian et al., NSDI 2013][Yang and Lam, ICNP 2013]

Taxonomy

5

Real-time Network

Verification

“Local” Similarity

Incremental Network

Verification

Packet Equivalence

Classes

New

[Khurshid et al., NSDI 2013][Kazemian et al., NSDI 2013][Yang and Lam, ICNP 2013]

[Khurshid et al., NSDI 2013]

Incremental Network Verification

ControlPlane

Network …

Data plane 2

Data plane 2

Data plane 2

Data plane k

1

2

5


ControlPlane

Network …

Data plane 2

Data plane 2

Data plane 2

Data plane k

1

2

6

Possibly a lotof overlap


ControlPlane

Network …

Data plane 2

Data plane 2

Data plane 2

Data plane k

1

2

7

Possibly a lotof overlap

Problem: disruptive changes (e.g. outages) are still challenging to analyze in real-time.

Our Contribution: Delta-net

Exploit similarity among forwarding behavior of packets through parts of the network, rather than its entirety.

Experiments: 10-100x faster on network-wide use cases

9

Example next ...

“delta of deltas”

Forwarding Graphs Per Equivalence Class

10

r1

r2

r3

r4

r1

r2

r3

r4s1

s2 s3

s4

range of IP addresses

Lowest priority

Highest priority


11

r1

r2

r3

r4

r1

r2

r3

r4s1

s2 s3

s4


12

r1

r2

r3

r4

r1

r2

r3

r4s1

s2 s3

s4


13

r1

r2

r3

r4

r1

r2

r3

r4s1

s2 s3

s4


14

+ + =

incrementally maintain asingle edge-labelled graph;represents all packet flows.

α1

α2,α3

α3

α2,α3,α4

Rather than re-computing forwarding graphs …



15

+ + =


α1

α2,α3

α3

α2,α3,α4



Single graph data structure to answer reachability queries, exposed through a simple C++ API.


16

+ + =


α1

α2,α3

α3

α2,α3,α4


“delta of deltas” atoms

Single graph data structure to answer reachability queries, exposed through a simple C++ API.

Atoms

“Complex Stuff = Simpler Stuff”

Example: factorization into prime numbers, e.g.

1479 = 3×17×29.

For IP prefix based networks, atoms:

17

α1 α2 α3

Σ

range of IP addresses

Compactness of Atoms

More compact than a Patricia tree, e.g. consider 𝛼0 = [0 : 10):

18

0

0 1

0

0

[0 : 8)

[8 : 10)

[0 : 8) = 00***

[8 : 10) = 0100*

Atoms and Graph Transformation

r1

r2

r3

r1

r2

r3

r4

α1 α2 α3

s1

s2 s3

s4

19


r1

r2

r3

r1

r2

r3

r4

α1 α2 α3

s1

s2 s3

s4

20

α1,α2,α3

α2,α3

α3


r1

r2

r3

r4

α1,α2,α3,α4

α2,α3

α3

r1

r2

r3

r4

α1 α4 α2 α3

s1

s2 s3

s4

21


r1

r2

r3

r4

α1,α2,α3,α4

α2,α3

α3

r1

r2

r3

r4

α1 α4 α2 α3

s1

s2 s3

s4

22


r1

r2

r3

r4

α1,α2,α3,α4

α2,α3

α3α1

α2,α3

α3

α2,α3,α4

r1

r2

r3

r4

α1 α4 α2 α3

Graph

Transformation

s1

s2 s3

s4

23

High-level Flowchart

24

Start

New atoms required?

Modify forwarding table

Create new atoms

Transform edge-labelled graph

Yes

No

More modifications?

No

Yes

Check properties

Refine precision of abstraction

End

All-Pairs Reachability

25

α1,α2

α2,α3

α3

α2,α3

Adaptation of Floyd-Warshall Algorithm

Essential for Datalog-style “what-if” queries:


26

α1,α2

α2,α3

α3

α2,α3

α2




27

α1,α2

α2,α3

α3

α2,α3

α2

α3



Experimental Setup (2 Classes of Data Sets)

Synthetic data sets similar to [Zeng et al., NSDI 2014]

Rocketfuel and Berkeley topologies from [Narayana et al., NSDI 2016]

IP prefixes from RouteViews project

SDN-IP [Lin et al., SIGCOMM 2013] in ONOS

Globally deployed, ONOS flagship application

28

SDN-IP Experimental Setup

29

Data Sets

30

Hundreds of million IP prefix rule insertions

SDN-IP

Synthetic

+ removals

Find all forwarding loops introduced by a rule insertion.

Experiments: Measuring Rule Updates

31

Find all forwarding loops introduced by a rule insertion.

Experiments: Measuring Rule Updates

32

Vast majority of rule updates analyzed in << 1 ms

What parts of the network are affected by link failures?

Query proposed by [Khurshid et al., NSDI 2013].

Summary: Delta-net can answer queries where Veriflow-RI times out.

Experiments: Beyond Network Updates

33

Concluding Remarks

Delta-net, a new real-time data plane checker.

Our research considers the “delta of deltas”.

Opens up new Datalog-style use cases, previously out of reach.

Data sets publically available now:

https://github.com/delta-net/datasets

For questions and comments, contact: [email protected].

We are also looking for industry/academic partners, interns etc.

Future work:

Parallelization

Multi-range support

Avoid space/time trade-offs, at what cost for query expressiveness?

34

https://github.com/delta-net/datasets

mailto:[email protected]

delta-net: real-time network verification using atoms · alex horn1, ali kheradmand2 and mukul r....

Documents