Revisiting Heavy-Hitter Detection on Commodity Programmable Switches

Khooi, Xin Zhe; Csikor, Levente; Li, Jialin; Kang, Min Suk; Divakara, Dinil Mon

doi:10.1109/netsoft51509.2021.9492531

Cited by 8 publications

(4 citation statements)

References 35 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Other monitoring tasks. In this subsection, we focused on heavy-hitter detection, which is a key building block for different monitoring tasks [12,30,46,54,62,64,72,74,75]. In our evaluation section, we show a similar accuracy degradation for a variety of additional monitoring tasks.…”

Section: Traffic Analysismentioning

confidence: 75%

“…Deployment of existing data-plane network monitoring solutions on multi-pipe switches. With the emergence of programmable high-speed ASIC switches, researchers and practitioners have devised a large plethora of highly sophisticated data-plane network monitoring solutions running at data-plane speeds [6,12,29,42,46,54,58,64,72,[74][75][76]. All these solutions operate at the level of a stream of packets that updates data structures in a single memory resource.…”

Section: Deployment Issuesmentioning

confidence: 99%

“…Three key requirements of today's monitoring solutions are: accuracy, i.e., the ability to correctly identify network events, low memory overheads, i.e., minimizing the amount of resources used on a switch, and reactiveness, i.e., the time required to detect an event. We discuss the rich body of literature that has long explored the trade-off among these requirements [12,29,33,42,46,54,57,64,72,[74][75][76].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Network Monitoring on Multi-Pipe Switches

Chiesa

Verdi

2023

SIGMETRICS Perform. Eval. Rev.

View full text Add to dashboard Cite

Programmable switches have been widely used to design network monitoring solutions that operate in the fast data-plane level, e.g., detecting heavy hitters, super-spreaders, computing flow size distributions and their entropy. Existing works assume packets access the same memory region in a switch. However, high-speed ASIC switches deploy multiple packet processing pipes, each equipped with its own independent memory. In this work, we first quantify the accuracy degradation due to splitting a monitoring data structure across multiple pipes (e.g., up to 3000x worse flow-size estimation average error). We then present PipeCache, a system that adapts existing data-plane mechanisms to multi-pipe switches by storing monitoring information for a traffic class into a single pipe. PipeCache stores monitoring information into a cache and piggybacks this information onto existing data packets to the correct pipe. Our implementation shows a 2-20x memory reduction to achieve an accuracy similar to single-pipe deployments.

show abstract

Section: Traffic Analysismentioning

confidence: 75%

Section: Deployment Issuesmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Network Monitoring on Multi-Pipe Switches

Chiesa

Verdi

2023

SIGMETRICS Perform. Eval. Rev.

View full text Add to dashboard Cite

show abstract

“…Consequently, varying workloads can be efficiently and effectively accommodated (redistributed) to maintain QoS and curb congestion; flows with the potential to overload links can be easily identified, re-routed, or throttled. Thus, detecting HH flows has been a subject of several research studies over the last decades for various use-cases, especially on programmable [19][20][21] and SDN. 10,[22][23][24][25] In programmable networks, the current trend is to enable designers to develop applications by invoking measurement tasks as primitives.…”

Section: Related Workmentioning

confidence: 99%

Towards threshold‐agnostic heavy‐hitter classification

et al. 2021

View full text Add to dashboard Cite

A heavy-hitter (HH) network traffic flow consumes considerably more network resources than other flows combined. The classification of HHs is critical to provide, among others, the required level of Quality of Service and reliability in both conventional and data center networks. HH classification is typically threshold-based. However, there is no consistent and accepted threshold or set of thresholds that would reliably classify flows. Furthermore, existing threshold-driven approaches use counters (e.g., duration, packets, and bytes); thus, their accuracy depends on how complete the flow information is. This paper paves the way to threshold-agnostic HH identification by proposing an approach that performs HH classification based on per-flow packet size distribution (PSD) and template matching (TM). PSD allows capturing the behavior and dynamism of network traffic flows (even from their first few packets). TM enables to classify HHs by measuring the similarity between the PSD of observed flows and a set of master templates representing the flow size behavior of HH classes. We evaluated the PSD-and TM-based approach using flows extracted from real traffic traces. Results show that our approach classifies HHs accurately and timely, corroborating that the threshold-less perspective is feasible for HH identification.

show abstract