Citation Context

...so gives a specific solution in the core to support fine-grained service routing, which is not addressed in Fabric and SDIA. Middleboxes: There have been many works on middleboxes recently (e.g., see =-=[18, 39, 40, 41, 42, 43]-=-). The closest works to SoftCell are PLayer [18] and SIMPLE [42]. PLayer is a pioneering work on how to enforce flexible middlebox traversals. SIMPLE takes a further step to enable better load balanci...

Citation Context

...ork functions virtualization (NFV) [12]. In parallel, software-defined networking (SDN) is being used to steer flows through appropriate NFs to enforce policies and jointly manage network and NF load =-=[17, 20, 22, 26, 32]-=-. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial a...

Citation Context

...t on top of DIFANE, the focus of the paper is very different from DUET. In vCRIB [16] authors propose to offload some of the traffic management rules from host agent to ToR switches, as well as to other host agents. Their goal is to ensure resource-aware and traffic-aware placement of rules. While vCRIB also faces problems such as managing network dynamics (e.g., VM migration), their main focus is quite different than DUET. SDN architecture and middleboxes: Similar to DUET, researchers have leveraged SDN architecture in the context of middleboxes to achieve policy enforcement and verification [18, 12], which is again a different goal than DUET. Improving single server performance: Researchers have substantially improved packet processing capabilities on commodity servers [23, 11], which could potentially improve SMux performance. But, these improvements are unlikely to bridge the differences in packet processing capabilities between HMux and SMux for the load balancer workload. Lastly, several algorithms for calculating flow hashes (e.g., resilient hashing [2], cuckoo-hashing [23]) offer a wide variety of trade-offs. We do not review them here, although DUET can leverage any advances in th...

Citation Context

...ing its payload information. We define a packet’s fingerprint (packet ID) as hash(payload) in the trace table. So packets in both input and output traces can still be joined by packet ID. Recent work =-=[8]-=- proposes to add tags to the packets and modify middleboxes to keep the tag, so that a middlebox’s ingress and egress packets can be mapped by tags. Another approach is to treat middleboxes as opaque ...

Citation Context

...anifest”sRegular trafficsTeststrafficsHostssControl PlanesData PlanesFigure 3: High-level architecture of FlowTest. tions. FlowTags requires new APIs for DPFs to expose information to SDN controllers =-=[10]-=-. Stratos explicitly replicates virtual middleboxes to avoid such issues [12]. While these provide concrete realizations, they cannot guarantee correctness; e.g., in the presence of failures. In fact,...

Citation Context

...narios. 25transformations). To address these concerns, we sketch a promising solution building on consistent system-wide sampling [13] and additional tools to provide the necessary middlebox context =-=[14]-=-. In many ways, the correctness requirements we highlight and the solution strategies for NFO have natural parallels in the cloud computing and distributed systems literature (see Section 5). That sai...

Citation Context

...ork can then compose while handling conflicts. I.e., Kinetic controls dynamic label assignments of endpoints while PGA captures and composes the network policy associated with each label (EPG). Refs. =-=[25, 17, 18]-=- have explored ways to effectively model middleboxes. In comparison, PGA’s modeling is more abstract but has been sufficient for the composition scenarios we targeted. Our ongoing work is exploring th...

Citation Context

... last switch in a traced pathlet. ToS limitations. Using the ToS field could be a problem, both in terms of the number of bits, and because there are often QoS-related usages for that field. FlowTags =-=[4]-=- has suggested several ways to overcome the limitations from encoding with the ToS field. For example, one option is to extend OpenFlow to match on the 16-bit IP ID field (if fragmentation is disabled...

Citation Context

...results. Middlebox management in SDN: A strand of research tries to redesign middleboxes to let a controller manage them [15, 31]. Another category manages middleboxes with the current implementation =-=[27, 14]-=-. In contrast, FAST pushes the limit of current switches to efficiently implement more network functions than simple forwarding. Local Controller Logic: Several works at the controller side ([17, 21, ...

Citation Context

...raverse a set of middleboxes in a specific order. In enterprise networks, such policies are enforced with careful middlebox interposition. Middlebox policies should be preserved when NFs are migrated to a virtualized infrastructure. Ideally, NF outsourcing should be indistinguishable from on-site middlebox deployment in terms of policy. This entails significant challenges for network service embedding (NSE) and provisioning. While recent work has addressed some of the network service provisioning issues (e.g., packet header modifications hindering policy enforcement) by employing flow tagging [12] or NF-graph transformations [14], [7], existing solutions for NSE are limited to heuristic algorithms that primarily aim at minimizing interrack traffic in data-centers (DC) [7], [14]. The NSE problem is further exacerbated by the location dependencies of certain NFs (e.g., proxies and caches should be placed in proximity to the enterprise network, while packet filters should be deployed close to traffic sources for increased bandwidth conservation at the event of DoS attacks) and the limited footprint of NF Providers (NFP). More precisely, a single NFP may not satisfy the location constraint...