Resource/Accuracy Tradeoffs in

Software-Defined Measurement

Masoud Moshref, Minlan Yu, Ramesh Govindan

HotSDN’13

2Motivation Tradeoff Case study DiscussionMotivation

Management policies need measurement

Traffic Engineering: • Find elephant flows to route [Hedera]• Estimate rack-to-rack traffic matrix [MicroTE]

Accounting:Tiered pricing based on network usage

Troubleshooting:• Find network bottlenecks of an application• Incast problem

3Motivation Tradeoff Case study DiscussionMotivation

Software Defined Measurement

3

ControllerTraffic

Engineering

Configure resources

1 Fetch statistics

2(Re)Configure resources

1

4Motivation Tradeoff Case study DiscussionMotivation

Challenges

Different measurements• Resource usage depends on measurement

Limited resources• Limited CPU/memory in switches• Limited control network bandwidth

Complexity of different primitives in switches• Counting by prefix matching (TCAM)• Counting based on hashes• Programming

Complexity of different primitives in switches• Counting by prefix matching (TCAM)• Counting based on hashes• Programming

5Motivation ArchitectureTradeoff Case study Discussion

Using Different Primitives for Measurement

Example: Finding heavy hitter IP when traffic from 10.0.1.0/24 goes beyond a threshold

Comparing primitives in performing a measurement task

6Motivation ArchitectureTradeoff Case study Discussion

Counting TCAM matches

0 1 1 0 * * * * 18

Filters Counters

1. Monitor 10.0.1.0/242. When goes beyond threshold, iteratively

search (e.g. binary search)

Controller10.0.1.0/24-

10.0.1.0/251

10.0.1.128/25

2

10.0.1.128/26

3

...

FetchInstall

• Large time-scale measurement• Measure-install loop latency• Controller link bandwidth

• Slowly varying traffic

7Motivation ArchitectureTradeoff Case study Discussion

2 1 5 1 0 0 1 0 5 3 1 0 2H

Src:10.0.1.5, Size:2

3

Controller

1. Fetch counters2. Approximate traffic for each

IP

• Uses cheaper resources (SRAM)• Not dependent on traffic history

• Use for varying traffic• Still history may help in large time scale to

optimize parameters

Sketches using hash based counters

8Motivation ArchitectureTradeoff Case study Discussion

Programming switches

10.0.1.5 90

10.0.1.1 25 10.0.1.3 50

10.0.1.12 17 10.0.1.10 3

Use more complex data structures/commands• Heap for finding large flows

Uses CPU resources• Can it keep up with line rate?

9Motivation ArchitectureTradeoff Case study Discussion

Summary of tradeoffs of primitives

Criteria Prefix matching

Hash-based counting

Programming

Memory usage TCAM SRAM SRAM

Bandwidth usage Medium Large Small

Time-scale Large Small Small

Traffic history sensitivity

Yes No No

Concerns Accuracy vs Resource

Accuracy vs Resource

Accuracy vs Resource

10

Case Study: Hierarchical Heavy Hitter Detection

11Motivation Case studyTradeoff Discussion

Hierarchical Heavy Hitters

36

26 10

12 14

5 7 12 2

5 5

2 30 5000

001

010

011

100

101

110

111

10* 11*

00* 01*

0** 1**

***

12Motivation Case studyTradeoff Discussion

Hierarchical Heavy Hitters

36

26 10

12 14

5 7 12 2

5 5

2 30 5000

001

010

011

100

101

110

111

10* 11*

00* 01*

0** 1**

***

Threshold=10

• Longest IP prefixes • Contribute a large amount of traffic• After excluding any HHH descendants in the

prefix tree

Motivation Case studyTradeoff Discussion

Algorithms for single switch HHH detection

13

26

- -

5

2 3

26

13 13

5

2 3

26

8 18

30

9 20

30

9 20

Approximate

Traverse tree

Prefix-based counting• Proposed an iterative algorithm at controller• Given TCAM capacity, monitor prefixes that maximize

accuracy

Hash-based counting• Use Hierarchical Count-Min sketch• Approximate traffic in all levels using sketches• Efficiently traverse IP tree at controller to find HHHs

14Motivation Case studyTradeoff Discussion

0

0.2

0.4

0.6

0.8

1

Re

call

20k256

80k1k

320k4k

0.05,Hash-based0.05,Prefix matching0.01,Hash-based0.01,Prefix matching

Evaluation

Sketches have better accuracy for small threshold (longer prefixes, higher variability)

Max-Cover saves bandwidth for large number of counters and large thresholds

SRAM countersTCAM counters

Normalize switch cost

80 SRAM 1 TCAM

15Motivation Tradeoff Case study DiscussionMotivation

Future work

ControllerTraffic

EngineeringAccountin

g

Software Defined Measurement

Nort

h-b

oun

dSouth

-bound

• Use joint information

• Guarantee accuracy

• Select primitive• Assign switch resources• Run global

measurement

Anomaly Detection