Jonathan S. Turner

OpenFlow: enabling innovation in campus networks

This whitepaper proposes OpenFlow: a way for researchers to run experimental protocols in the networks they use every day. OpenFlow is based on an Ethernet switch, with an internal flow-table, and a standardized interface to add and remove flow entries. Our goal is to encourage networking vendors to add OpenFlow to their switch products for deployment in college campus backbones and wiring closets. We believe that OpenFlow is a pragmatic compromise: on one hand, it allows researchers to run experiments on heterogeneous switches in a uniform way at line-rate and with high port-density; while on the other hand, vendors do not need to expose the internal workings of their switches. In addition to allowing researchers to evaluate their ideas in real-world traffic settings, OpenFlow could serve as a useful campus component in proposed large-scale testbeds like GENI. Two buildings at Stanford University will soon run OpenFlow networks, using commercial Ethernet switches and routers. We will work to encourage deployment at other schools; and We encourage you to consider deploying OpenFlow in your university network too

Overcoming the Internet impasse through virtualization

The Internet architecture has proven its worth by the vast array of applications it now supports and the wide variety of network technologies over which it currently runs. Most current Internet research involves either empirical measurement studies or incremental modifications that can be deployed without major architectural changes. Easy access to virtual testbeds could foster a renaissance in applied architectural research that extends beyond these incrementally deployable designs.

Scalable high speed IP routing lookups

Internet address lookup is a challenging problem because of increasing routing table sizes, increased traffic, higher speed links, and the migration to 128 bit IPv6 addresses. IP routing lookup requires computing the best matching prefix, for which standard solutions like hashing were believed to be inapplicable. The best existing solution we know of, BSD radix tries, scales badly as IP moves to 128 bit addresses. Our paper describes a new algorithm for best matching prefix using binary search on hash tables organized by prefix lengths. Our scheme scales very well as address and routing table sizes increase: independent of the table size, it requires a worst case time of log2(address bits) hash lookups. Thus only 5 hash lookups are needed for IPv4 and 7 for IPv6. We also introduce Mutating Binary Search and other optimizations that, for a typical IPv4 backbone router with over 33,000 entries, considerably reduce the average number of hashes to less than 2, of which one hash can be simplified to an indexed array access. We expect similar average case behavior for IPv6.

New directions in communications (or which way to the information age

hat a difference 25 years makes! When this article was written the telecommunications industry was still a heavily regulated, non-competitive but highly integrated place; the Internet was the private preserve of congnoscenti at a handful of research universities; integrated circuits with a feature size of 2 micron were state-of-the-art; and the room-sized minicomputers of the day could send and receive maybe a thousand packets per second, on a good day. This article articulated an observation that was gaining recognition throughout the early 1980s: first, that the fragmentation of the communications infrastructure into several distinct application-specific networks was wasteful and unnecessary; and second, that by combining concepts from packet switching with the implementation practices of circuit switching (highly parallel, hardware switching systems), one could develop systems with unprecedented flexibility and the performance levels and reliability needed to support large-scale, ubiquitous deployment. By the mid to late 1980s, these ideas were being pursued most vigorously in the development of ATM standards and technology, which was widely expected to play a leading role in the next generation of the public telecommunications infrastructure. The article outlined some of the key elements of such an integrated network technology, capable of supporting voice, data, and video communication and having the flexibility to accommodate new services as the need arose. Integrated switching architectures, generalized connection signaling protocols, quality-of-service, multicast switching, and routing were all identified as key challenges to be addressed. Subsequent years have seen tremendous progress on all these fronts in both the ATM context and in the now all-important Internet context. The changes in packet switching technology over the last two decades are particularly striking. While advanced switching architectures were first developed in the ATM context, these concepts have been applied with striking success in Ethernet switches and IP routers in recent years. Emerging IP router products with aggregate capacities exceeding a terabit per second are becoming available now, and gigabit Ethernet switches are available for just hundreds of dollars per port. Progress on other fronts has been more disappointing. While practical and effective solutions for connection signaling, quality-of-service, congestion control, and multicast have been developed and demonstrated, there has been little progress toward widespread commercial deployment. We still operate separate networks for voice, data, and video, and while the Internet promises to play a growing role in voice and video communication, it cannot achieve that promise without major technical improvements. Fortunately, the potential value of such improvements is becoming more and more clear, as the Internet’s role in our evolving information society continues to develop. While challenges remain, there seems little doubt that the necessary changes can and will be made, and that the full realization of the vision outlined in this article 25 years ago is now within our grasp. Jonathan S. Turner

Terabit burst switching

Demand for network bandwidth is growing at unprecedented rates, placing growing demands on switching and transmission technologies. Wavelength division multiplexing will soon make it possible to combine hundreds of gigabit channels on a single fiber. This paper presents an architecture for Burst Switching Systems designed to switch data among WDM links, treating each link as a shared resource rather than just a collection of independent channels. The proposed network architecture separates burst level data and control, allowing major simplifications in the data path in order to facilitate all-optical implementations. To handle short data bursts efficiently, the burst level control mechanisms in burst switching systems must keep track of future resource availability when assigning arriving data bursts to channels or storage locations. The resulting Lookahead Resource Management problems raise new issues and require the invention of completely new types of high speed control mechanisms. This paper introduces these problems and describes approaches to burst level resource management that attempt to strike an appropriate balance between high speed operation and efficiency of resource usage.

Algorithms to accelerate multiple regular expressions matching for deep packet inspection

There is a growing demand for network devices capable of examining the content of data packets in order to improve network security and provide application-specific services. Most high performance systems that perform deep packet inspection implement simple string matching algorithms to match packets against a large, but finite set of strings. owever, there is growing interest in the use of regular expression-based pattern matching, since regular expressions offer superior expressive power and flexibility. Deterministic finite automata (DFA) representations are typically used to implement regular expressions. However, DFA representations of regular expression sets arising in network applications require large amounts of memory, limiting their practical application.In this paper, we introduce a new representation for regular expressions, called the Delayed Input DFA (D2FA), which substantially reduces space equirements as compared to a DFA. A D2FA is constructed by transforming a DFA via incrementally replacing several transitions of the automaton with a single default transition. Our approach dramatically reduces the number of distinct transitions between states. For a collection of regular expressions drawn from current commercial and academic systems, a D2FA representation reduces transitions by more than 95%. Given the substantially reduced space equirements, we describe an efficient architecture that can perform deep packet inspection at multi-gigabit rates. Our architecture uses multiple on-chip memories in such a way that each remains uniformly occupied and accessed over a short duration, thus effectively distributing the load and enabling high throughput. Our architecture can provide ostffective packet content scanning at OC-192 rates with memory requirements that are consistent with current ASIC technology.

ClassBench: a packet classification benchmark

Packet classification is an enabling technology for next generation network services and often a performance bottleneck in high-performance routers. The performance and capacity of many classification algorithms and devices, including TCAMs, depend upon properties of filter sets and query patterns. Despite the pressing need, no standard performance evaluation tools or filter sets are publicly available. In response to this problem, we present ClassBench, a suite of tools for benchmarking packet classification algorithms and devices. ClassBench includes a filter set generator that produces synthetic filter sets that accurately model the characteristics of real filter sets. Along with varying the size of the filter sets, we provide high-level control over the composition of the filters in the resulting filter set. The tool suite also includes a trace generator that produces a sequence of packet headers to exercise packet classification algorithms with respect to a given filter set. Along with specifying the relative size of the trace, we provide a simple mechanism for controlling locality of reference. While we have already found ClassBench to be very useful in our own research, we seek to eliminate the significant access barriers to realistic test vectors for researchers and initiate a broader discussion to guide the refinement of the tools and codification of a formal benchmarking methodology. (The ClassBench tools are publicly available at the following site: http://www.arl.wustl.edu/~det3/ClassBench/.)

Efficient Mapping of Virtual Networks onto a Shared Substrate

Virtualization has been proposed as a vehicle for overcoming the growing problem of internet ossification [1]. This paper studies the problem of mapping diverse virtual networks onto a common physical substrate. In particular, we develop a method for mapping a virtual network onto a substrate network in a cost-efficient way, while allocating sufficient capacity to virtual network links to ensure that the virtual network can handle any traffic pattern allowed by a general set of traffic constraints. Our approach attempts to find the best topology in a family of backbone-star topologies, in which a subset of nodes constitute the backbone, and the remaining nodes each connect to the nearest backbone node. We investigate the relative cost-effectiveness of different backbone topologies on different substrate networks, under a wide range of traffic conditions. Specifically, we study how the most cost-effective topology changes as the tightness of pairwise traffic constraints and the constraints on traffic locality are varied. In general, we find that as pairwise traffic constraints are relaxed, the least-cost backbone topology becomes increasingly “tree-like”. We also find that the cost of the constructed virtual networks is usually no more than 1.5 times a computed lower bound on the network cost and that the quality of solutions improves as the traffic locality gets weaker.

Design of an Integrated Services Packet Network

The Integrated Services Digital Network (ISDN) has been proposed as a way of providing integrated voice and data communications services on a universal or near-universal basis. In this paper, I argue that the evolutionary approach inherent in current ISDN proposals is unlikely to provide an effective long-term solution and I advocate a more revolutionary approach, based on the use of advanced packet-switching technology. The bulk of this paper is devoted to a detailed description of an Integrated Services Packet Network (ISPN), which I offer as an alternative to current ISDN proposals.

Packet classification using extended TCAMs

CAMs are the most popular practical method for implementing packet classification in high performance routers. Their principal drawbacks are high power consumption and inefficient representation of filters with port ranges. A recent paper [Narlikar, et al., 2003] showed how partitioned TCAMs could be used to implement IP route lookup with dramatically lower power consumption. We extend the ideas in [Narlikar, et al., 2003] to address the more challenging problem of general packet classification. We describe two extensions to the standard TCAM architecture. The first organizes the TCAM as a two level hierarchy in which an index block is used to enable/disable the querying of the main storage blocks. The second incorporates circuits for range comparisons directly within the TCAM memory array. Extended TCAMs can deliver high performance (100 million lookups per second) for large filter sets (100,000 filters), while reducing power consumption by a factor of ten and improving space efficiency by a factor of three.