Flexible Routers

1
Flexible Routers

• George Varghese
• Cisco Systems and University of California, San
  Diego

2
GENI and Router Vendors

• GENI seeks to allow large scale experimentation
  with routers and perhaps encourage whole new
  protocols to emerge.
• Virtual/metarouters allow isolation of each
  experimenters protocols in protected slice
• Fine from research standpoint but what about
  router vendors?
• Virtual routers already popular but these are
  several customers sharing the same fixed
  functions in a router

3
Beyond smaller, faster, cheaper

• Routers have historically been compared
  (LightReading tests) by cost-performance and
  provenance. But (IBM Autonomic Computing)
• In fact, a continued obsession with smaller,
  faster, cheaper is really a distraction . . the
  real obstacle is complexity.
• Two supporting trends
• Complexity of running networks (OpEx) may be a
  serious obstacle to Web Services/e-commerce
• Commoditization of routers using merchant silicon

4
Flexible Routers

• Economic incentive for router vendors to allow
  more flexible functions that allow customers
  manage complexity.
• Some Cisco Examples (market pull)
• NetFlow ? Flexible NetFlow
• Packet Classification ? Flexible Packet Matching
• Fixed Packet Parsing ? Flexible Parsers
• Perhaps not complete flexibility at lower speeds
  (GENI) but limited flexibility at the highest
  speeds

5
What functions?

• Functions that address complexity
• Flexible Measurement Allow managers to ask
  flexible queries. Hardcoding/NetFlow insufficient
• Flexible Security Identify attack patterns to
  mitigate attacks. Detection Heuristics change
• Flexible fault detection Identify/localize/fix
  faults. Need flexible measures as new faults
  emerge
• Motivated by market pull and technology push

6
Market Pull 1 Better ROI for Networks
reroute or add B/W
Customer Site 2
Customer Site 1
Customer Site 3
ISP

• Better ROI Optimize resources (OSPF weights,
  light up fibers) based on resource usage
  patterns.
• P2P Traffic Identify and rate control P2P
  traffic
• Competitive Edge As banks use data mining to
  optimize loan portfolios, can ISPs optimize
  bandwidth portfolio?

IETF BOF
7
Why flexible, high speed measurement?

• Cisco today has SNMP counters and NetFlow logs.
• NetFlow Issues
• Tool need a tool to process front end tools do
  not support flexible queries
• Export large B/W needed to export to tool loss
• Limited flexibility (partially addressed by
  Flexible NetFlow)
• Poor at counting flows Not real-time Several
  minutes to receive and post-process.
• SNMP Issues
• Hardwired support for a few low granularity
  counters (total packets, bytes, errors on each
  interface)
• Large time scales (e.g., 1 minute) good for
  provisioning but bad for performance anomalies at
  small time scales

8
Market Pull 2 Costs of (In)Security
IDS
Attacker
Victim
Zombie 1
(patches)
traceback
Firewall
ISP
Zombie N

• Cost Too many isolated perimeter solutions
  (firewalls, IDS devices). Total cost of ownership
  (TCO) very high.
• Delay When perimeter detects, damage is already
  done.
• Complexity End users finding and installing
  patches or manual procedures for traceback etc.,

Gartner Research Security solutions deployed
within enterprises and ISPs by 2006
9
Example Too many flavors of Anomaly Detection

• Anomaly detection used to detect new attacks/P2P
  traffic etc
• Several flavors as examples
• Riverhead Anomalies based on large number of
  spoofed sources sending to a server. (Does more)
• HP Anomalous if sources sending more K
  connections/second
• Maazu, Arbor Anomalous if a source sends more
  than K new connections per second compared to
  baseline connection matrix.
• NetSift Anomalous if content repeats K times

10
Flexible AD as an example

• Changing world requires changing AD because
  definition of anomalous changes
• New good behaviors (e.g. Skype, BitTorrent) look
  like old bad behaviors
• Attackers are constantly inventing new bad
  behaviors (e.g., encrypted attacks)
• Latency
• Theoretically, SIMs that take input from various
  feeds and can write flexible rules can do
  Flexible AD.
• Disadvantage is latency for fast attacks.
• Useful to build somewhat flexible but high speed
  AD into routers. More general flexible security
  as well.

11
Market Pull 3 Costs of Fault Tolerance

• Cost Anecdotal evidence from our friends at ATT
  (Albert Greenberg, Jennifer Yates) say that
  network operators spend a large amount of time
  diagnosing and dealing with faults
• Some Causes Ephemeral identifiers (VCIs, VPNs,
  MPLS labels), non-determinism (e.g., hidden hash
  functions), cross-layer interactions (IP and
  optical layer), hidden dependencies (several IP
  circuits over a single Optical Amplifier)

12
Technology Push Streaming Algorithms and
Hardware Gates

• Algorithms Recent major thrust in streaming
  algorithms in database, web analysis, theory,
  networks
• Hardware Memory accesses expensive (not scaling with connections (gates are plentiful.
• Mapping Randomized streaming algorithms (e.g.,
  Bloom Filters) map well to network ASICs.
• Opportunity Invent or adapt streaming algorithms
  for networking patterns to provide limited
  flexibility but at very high speeds.

13
Approaches to Flexibility

• FPGAs and Network Processors Hard to meet
  cost/performance goals.
• ASICs and Primitives Embed high level
  primitives into ASICs on every line card that can
  then be composed at will.
• Appears to be able to get performance with fair
  amount of flexibility.

14
Key Issue User Model

• Many routers are programmable internally to allow
  new lookup algorithms, QoS etc. But often
  requires microcoders.
• For flexibility to be a market force, ordinary
  users must be able to change router function.
• Would be a good by-product of GENI research if
  router programming can be done without always
  needing to program FPGAs
• What is a good API/good user model. StreamSQL
  and BPF are two extremes.

15
Conclusions

• GENI metarouter/virtual router proposal
• allows routers to be arbitrarily programmed by
  knowledgeable researchers
• Based on current plans, cost-performance (NPUs,
  FPGAs) may lag ASIC based router/switches at high
  speeds.
• May not have a clear market case
• Limited flexibility at high speeds
• Allows routers to change function in a limited
  sense based on simple programming by operators
• May have good cost-performance to compete with
  fixed function routers based on ASICs
• May have a market case to address the complexity
  of networks esp wrt to measurement, security
  fault-tolerance
• Nevertheless, these two approaches can learn a
  great deal from each other.