Vprom notes

vPROM: SDN Network vSwitch Enhanced programmable measurement

significance

Although network measurement is very important for network management , But the current network measurement technology is not perfect , There is little visibility into detailed network behavior , And usually requires a high level of human intervention . With the growth of network scale and complexity , This practice has become increasingly ineffective .

Challenge

• Monitoring and other applications ( Such as forwarding ) The interference between can not be ignored . Each application has its own goals and a set of policies to implement . An application installation / Deleted flow rules often interfere with other application installations / Delete overlapping rules .
• Programmable measurements may require the continuous involvement of the controller .
• Monitor the number of messages and bytes by associating with the flow item in the forwarding table , Neither flexible , It is not enough to support various monitoring applications .

programme

In this paper , We proposed vPROM, This is a kind of vSwitch Enhanced SDN Programmable measurement framework , It can automate the measurement process , Minimize the use of measurement resources .vPROM utilize SDN The programmability of , Expanded Pyretic Runtime system and OpenFlow Network interface , The automation of measurement is realized . By getting only the necessary statistics , The required measurement resources can be minimized , Use instrumentation with user-defined monitoring Open vSwitches Make it possible . By decoupling monitoring and routing ,vPROM Reduces interference between measurement applications and other applications , The frequent participation of the controller is eliminated .

The picture above depicts vPROM The architecture of . As shown in the figure ,vPROM from 5 It consists of three main components :

• UMON( A kind of open vswitch) vswitch、 Instrumented Open vswitch, Provide user-defined monitoring functions and some local application functions , Push from the central controller to the edge ;
• OpenFlow+, Enhanced OpenFlow API, Allow applications to run in UMON Set monitoring rules on , And control the operation in vswitch Application thread on ;
• Ryu client , As a runtime system and Ryu Interpreter between controllers ;
• Pyretic+, Extended Pyretic Runtime system , You can put a vPROM The application resolves to traditional SDN The flow rule set and UMON vSwitches Monitoring rule set ;
• Use extended Pyretic language-written vPROM Applications .vPROM Applications from traditional SDN Switch and UMON The switch obtains the measurement data .

Open questions

• Further build more vPROM Applications , And study how to use UMON And physics SDN The switch acts as a monitoring point .

• Behavior based anomaly detection can be used as coarse-grained monitoring clues .

summary

Behavior based anomaly detection can be used as coarse-grained monitoring clues .

summary

This paper introduces vPROM Design and implementation of , This is a kind of vSwitch Enhanced programmable measurement framework , Allows users to program network measurement and control applications .vPROM Use instrumented UMON (Open vswitch) As a measuring point , And will OpenFlow API Extended to OpenFlow+, send UMON Can be used by the application through SDN The controller directly controls . stay vPROM in , We will also Pyretic The programming language and runtime system are extended to Pyretic+, And build a controller client , To support the automation of programmable measurement . In order to prove its validity , We also built a DDoS And port scan attack detection applications , It demonstrates vPROM The main characteristics of . Performance evaluation and comparison with other methods show that vPROM The advantages of