VeriFlow : Verifying Network-Wide Invariants in Real Time

download VeriFlow : Verifying Network-Wide Invariants in Real Time

of 18

  • date post

  • Category


  • view

  • download


Embed Size (px)


VeriFlow : Verifying Network-Wide Invariants in Real Time. Ahmed Khurshid , Wenxuan Zhou, Matthew Caesar, P. Brighten Godfrey University of Illinois Presented by Ofri Ziv November 2013. Outline. Motivation Design Evaluation Example Conclusion. Motivation. Networks are complex - PowerPoint PPT Presentation

Transcript of VeriFlow : Verifying Network-Wide Invariants in Real Time

PowerPoint Presentation

VeriFlow: Verifying Network-Wide Invariants in Real TimeAhmed Khurshid, Wenxuan Zhou, Matthew Caesar, P. Brighten GodfreyUniversity of Illinois

Presented by Ofri ZivNovember 2013OutlineMotivation




ConclusionMotivationNetworks are complexEnsure networks correctness and security

SDN increases software complexityMultiple applications program the physical network simultaneously

Check network-wide invariants as network evolves

Prevent bugs as they arise

It is very hard to test all its components and protocols to find misconfigurationBugs will continue to existMay result in conflicting rules that alter the intended behavior of one or more applicationsProvide immediate warning Block dangerous changes3Bugs EffectAllow unauthorized packets to enter a secured zone in a network

Make services and the infrastructure prone to attacks

Make critical services unavailable

Affect network performanceConfiguration Verification (Offline)Problems:Prediction is difficultVarious configuration languagesDynamic distributed protocolsMiss control-plane implementation bugs

InputPredictVeriFlow approach: Data-plane VerificationAdvantages:Less predictionCloser to actual network behaviorUnified analysis for multiple control-plane protocolsCatch control-plane implementation bugsInputPredictChallengesObtaining real time view of the networkInterpose between controller and network elementsUtilize the centralized data-plane view available in an SDN (Software-Defined Network)

Verification speed

Monitor all flows- Achieve extremely low latency during checks, so that network performance wont be affected7The Tool: VeriFlowChecks network-wide invariants in real time using data-plane stateAbsence of routing loops, black holes, access control violations, etc.

Functions byMonitoring dynamic changes in the networkConstructing a model of the network behaviorUsing custom algorithms to automatically derive whether the network contains errorsVeriFlow Overview

Report:network invariant violationAffected set of packetsGood RuleBad RulePaint the update from the controllerGood rules are sent to the network elementsRules violating network invariants are diagnosed (invariant violated, affected set of packets)9Limit the search spaceEquivalence class: Packets experiencing the same forwarding actions throughout the network

Fw Rules:

Eq. classes: 1 2 3 4 only equivalence classes affected by the update using a trie-based data-structure

Trie data-structure holds the entire networks forwarding rules.The leaves of the trie store the actual rules (pairs of (device, rule)), which are represented by the path that leads to them.

For each new rule we traverse the trie until we get a set of overlapping rules.10AComputing Equivalence ClassesA = (Match =0.1, Action, device)B = (Match =0.*, Action, device)

Eq. Classes {0.0}, {0.1}

01*B000111***Represent Forwarding RulesForwarding graphs:Nodes representing network devicesEdges representing forwarding rules

All the information to answer queries

Eq. Class 1

Eq. Class 2

12Check InvariantsQueries:Black holesRouting loopsVLANs IsolationAccess control policies

Response:Good Rules Send flow to network elementBad Rules Report: invariant violated, affected set of packets

Evaluation #1 Microbenchmarking VeriFlow run timeGoal: Observe VeriFlows different phases contribution to the overall run time

Simulated an IP network172 routers

Replayed BGP traces5 million RIB entries90K BGP updates

Evaluation #2 Effect on TCP connection setup latencyExperiment #2 Impact of VeriFlow on TCP connection setup latency

Mininet OpenFlow network10 switches arranged in chain-like topology A host connected to every switch

NOX controller running learning switch app

TCP connections between random pairs of hosts

Overhead imposed by the proxyOverhead imposed by the verification

Most of the overhead caused by veriFlow is the proxy (only 7% out of 69% is the verification)15Future WorkHandling packet transformations

Deciding when to check (transactions)

Handling queries other than reachability

Dealing with multiple controllersGenerating additional equivalence classes and their corresponding forwarding graphs, to address the changes in packet header due to the transformations.VeriFlow may report a violation while processing set of rules one-by-one.For example: Ensure certain flows dont use the same link, limit the number of flows on a link.VeriFlow assumes it has a complete view of the network. In multi-controller scenario this task is challenging.

16Demo applicationhosts = {}switches = {(sw1, sw2): port}

def packet_in(pkt, in_port, device):if (GARP == pkt.proto):if (hosts.has_key(pkt.src_ip)):(d,i) = hosts[pkt.src_ip]delete_flow(match=pkt.src_ip, d)hosts[pkt.src_ip] = (device, in_port)install_flow(match=pkt.src_ip, out=in_port, device)

else if (hosts.has_key(pkt.dst_ip)):(d,i) = hosts[pkt.dst_ip]install_flow(match=pkt.dst_ip, out=switches[(device,d)], device)send_packet(pkt, switches[(device,d)], device)

ConclusionVeriFlow achieves real-time verification:A layer between SDN controller & network elementsFind faulty flows issued by SDN applicationsVerify network-wide invariants as each flow is inserted

Can prevent a flow from reaching the network- Rigorous checking of network-wide invariants within hundreds of microseconds as each flow is inserted.