SFCMon: An Efficient and Scalable Monitoring System for Network Flows in SFC-enabled Domains

Abstract

A comprehensive monitoring system is essential to assist solutions for most of SFC problems. Therefore, in this work, we propose SFCMon, an efficient and scalable monitoring solution to keep track network flows in SFC environments. To achieve the desired goals, SFCMon works with a pipeline of probabilistic data structures to detect and store large flows as well as perflow counters. For evaluation purposes, based on the SFC reference architecture defined by RFC 7665, we implement a Proof-of-Concept (PoC) framework, which provides a P4-based SFC switch and Python-based SFC Controller. Presented initial experiments demonstrate that SFCMon introduces a negligible performance penalty while providing significant scalability gains.

A real‐time attack defense framework for 5G network slicing

“…Concerning the data plane, FrameRTP4 implements a customizable P4 program to provide line‐rate processing directly within the switches. To this end, such program provides the following functionalities: (i) an SFC implementation to enable low‐level lifecycle management of NS instances; (ii) an efficient and scalable P4 table‐based ACL that applies wildcard rules for the detection and mitigation of known attacks; and (iii) an efficient and scalable monitoring solution, namely SFCMon, to keep track network flows in SFC environments.…”

“…The first component is an SFC implementation that aims to enable low‐level lifecycle management of NS instances. For this, we adapt a reference implementation that was proposed in one of our previous works . SFC is a key enabler for 5G NS .…”

“…Finally, the third component consists of an efficient and scalable monitoring solution, namely SFCMon, to keep track network flows in SFC environments. To this end, we adapt a reference implementation that was proposed in one of our previous works . To achieve the desired goals, SFCMon works with a pipeline of probabilistic data structures to detect large flows and to store some of their features, such as packet counting.…”

“…Furthermore, this program consists of an efficient and scalable P4 table‐based ACL that applies wildcard rules for the detection and mitigation of known attacks. Besides, the P4 program deploys a monitoring system, namely SFCMon, one of our previous work that uses BFs and sketches to support an efficient and scalable mechanism to track network flows.…”

“…Besides, we follow the RFC 8300 to define a P4 header for the Network Service Header (NSH). An efficient and scalable monitoring solution, namely SFCMon , a P4 program to keep track network flows in SFC environments. For this, we adapt a reference implementation that was proposed in one of our previous works . An efficient and scalable P4‐based ACL implementation that applies wildcard rules for the real‐time detection and mitigation of known attacks. The FrameRTP4 Switch , a P4 program reference implementation that provides a processing pipeline that integrates the three components above. The FrameRTP4 Controller , a P4Runtime‐based SDN controller reference implementation that enables flow control and SFCMon management on one or more FrameRTP4 Switches. A Wildcard Rule Generator solution that implements an algorithm for 5‐tuple rules compression that aims to reduce the number of rules required to realize policies on a single FrameRTP4 Switch. The FrameRTP4 Orchestrator , a Python‐based program that controls one or more FrameRTP4 Controllers to provide security for end‐to‐end NS.…”