HybridCuts: A Scheme Combining Decomposition and Cutting for Packet Classification

Transcription

1 HybridCuts: A Scheme Combining Decomposition and Cutting for Packet Classification Wenjun Li Xianfeng Li School of Electronic and Computer Engineering (ECE) Peking University IEEE Hot Interconnects 21 San Jose, CA, August 21-22, 2013

2 Outline Background HybridCuts Evaluation Conclusion School of ECE, Peking University 2

3 PART I: Background School of ECE, Peking University 3

4 Packet Classification Key for policy enforcement in packet forwarding Router / Firewall Incoming Packet Outgoing Packet Forwarding Engine Header Fibre Optics Flow Classification Fibre Optics Header Classifier (Rule Database) Predicate Action Payload Payload # SA DA SP DP Prot Action r / [1,65534] [1,65534] TCP accept r / /24 80 [1,65534] UDP accept r 3 * * * * * discard School of ECE, Peking University 4

5 Why Yet Another Paper? A well established problem without Well established solutions Algorithmic: Desired but speed/memory inefficient Architectural: Fast but expensive, power hungry, poor scalability and suffer from range expansion School of ECE, Peking University 5

6 Recent Efforts on Algo. Solutions EffiCuts [SIGCOMM 10] Reduction by Separation Equal-dense cutting, etc C B A D C G F B E A D F E Pros Reduction on memory consumption Cons Increase on #memory accesses G School of ECE, Peking University 6

7 Better Solutions? Rule separation: the right direction Better separations (with less rule groups) + Better cuttings (by exploiting characteristics) School of ECE, Peking University 7

8 A Little Review... Decomposition Cutting Y R1 R2 R Packet P 4 Y R4 X R5 Root R6 Node R2, R5 R3, R5 R6 X R1, R2 R4 School of ECE, Peking University 8

9 PART II: HybridCuts School of ECE, Peking University 9

10 Original Rule Set HybridCuts A two-stage scheme 1 st Stage 2 nd Stage Decomposition Cutting SA-subset DA-subset SP-subset DP-subset Big-subset Decision Tree SA Decision Tree DA Decision Tree SP Decision Tree DP Decision Tree Big Preprocessing && Constructing search structure School of ECE, Peking University 10

11 Observations (1) Very few big rules! Threshold: (SA,DA,SP,DP) School of ECE, Peking University 11

12 Observation (2) R14 R7 R14 R8 R9 R10 R11 R13 X-Subset R6 Y R8 R5 R9 R10 R4 R11 Decomposition X R7 R12 R3 R13 R6 Y R5 R1 R2 R12 R4 Y-Subset X Y R3 R1 R2 X School of ECE, Peking University 12

13 Match Aggregation Packet Header Priority Selector Packet Header Decomposition Search in SA Rules matching SA Traditional Decomposition Search in DA Search in SP Search in DP Rules matching DA Rules matching SP Rules matching DP Highest Priority Rule Search in Prot Rules matching Prot SA-subset tree Best matching in SA-subset Improved Decomposition DA-subset tree SP-subset tree Best matching in DA-subset Best matching in SP-subset Highest Priority Rule DP-subset tree Best matching in DP-subset Big-subset tree Best matching in Big-subset School of ECE, Peking University 13

14 FiCuts: Fixed intelligent Cuttings Cut 2 Cut 0 R14 R14 Y R8 X R9 R10 Root (Cut 0) (Y-Cuts:2) R11 R13 R12 Cut 0 Cut 1 HiCutsàFiCuts Simpler but more efficient Y R8 X R9 Root (Cut 0) (X-Cuts:4) R10 R11 R13 R12 Leaf 1 R12 Node 1 (Cut 1) (Y-Cuts:2) Leaf 2 R8 R9 R11 R13 Leaf 3 R8 R9 Node 2 (Cut 2) (X-Cuts:2) Leaf 4 R10 R11 R14 Leaf 1 R8 Leaf 2 R9 Leaf 3 R10 Leaf 4 R11 R12 R13 R14 School of ECE, Peking University 14

15 A hybrid FiCuts + HyperCuts When to switch to HyperCuts? Subspace becomes small, and rule replication becomes intense A threshold to trigger the FiCut=>HyperCuts switching School of ECE, Peking University 15

16 Effectiveness (1) 14 à36 rules R8 R5 R6 R7 R10 R11 R14 R9 R4 R3 R13 Y Root R1 R2 R12 X Node1 Node2 Node3 Node4 Leaf1 R1,2 Leaf2 R2 Leaf3 R3,8 Leaf4 R3,9 Leaf5 R2 Leaf6 R2,12 Leaf7 R4 Leaf8 R11,13 Leaf9 R5,8 Leaf10 R9 Node5 Leaf11 R6,7 Leaf12 R10 Leaf13 R11 Node6 Node7 Leaf14 R6,8 Leaf15 R6 Leaf16 R8 Leaf17 R7 Leaf18 R6,10 Leaf19 R6,10 Leaf20 R7 Leaf21 R7 Leaf22 R6,11 Leaf23 R11 Leaf24 R7 Leaf25 R14 HyperCuts School of ECE, Peking University 16

17 Effectiveness (2) 14 à14 rules X_FiCuts 0 R14 R6 R7 R8 R9 R10 R11 HyperCuts 0_Y R5 R13 Y R4 Y_FiCuts 0 R12 Y R1 R3 R2 X Root (X_FiCuts 0) (Cuts:4) HyperCuts 0_X X Root (Y_FiCuts 0) (Cuts:4) Leaf 1 R8 Leaf 2 R9 Leaf 3 R10 Node 1 (HyperCuts 0) (X-Cuts:2) (Y-Cuts:2) Leaf 1 R1 Leaf 2 R3 R4 Leaf 3 R5 Leaf 4 R6 R7 Leaf 4 R11 (PushUp) Leaf 5 R11 R12 R13 Leaf 6 R11 Leaf 7 R11 R14 Y-Subset HybridCuts X-Subset School of ECE, Peking University 17

18 Optimization Can be smaller? 5à3 subsets Threshold: (SA,DA) School of ECE, Peking University 18

19 PART III: Evaluation School of ECE, Peking University 19

20 Experimental Setup Tested with A publicly available rule set from Washington University Used the ACL & FW & IPC 1K, 10K ClassBench Generate ACL & FW & IPC 100K Compared with HyperCuts && EffiCuts Primary metrics Memory consumption (Bytes/rule) Number of memory accesses Open Source for HybridCuts School of ECE, Peking University 20

21 Memory Consumption HyperCuts EffiCuts HybridCuts 1.00E+07 Bytes per rule 1.00E E E E E E E+00 ACL_1K ACL_10K ACL_100K FW_1K FW_10K FW_100K IPC_1K IPC_10K IPC_100K School of ECE, Peking University 21

22 Memory Accesses HyperCuts EffiCuts HybridCuts 120 Overall Memory Accesses ACL_1K ACL_10K ACL_100K FW_1K FW_10K FW_100K IPC_1K IPC_10K IPC_100K School of ECE, Peking University 22

23 More Insights The sizes of subsets The sizes of trees SA_SIZE DA_SIZE BIG_SIZE SA_MEM DA_MEM BIG_MEM 100% 100% 90% 90% 80% 80% 70% 70% 60% 60% 50% 50% 40% 40% 30% 30% 20% 20% 10% 10% 0% ACL_1K ACL_10K ACL_100K FW_1K FW_10K FW_100K IPC_1K IPC_10K IPC_100K 0% ACL_1K ACL_10K ACL_100K FW_1K FW_10K FW_100K IPC_1K IPC_10K IPC_100K School of ECE, Peking University 23

24 Potential Gain with Parallelization Overall #memory accesses Worst-case tree height 0 ACL_1K ACL_10K ACL_100K FW_1K FW_10K FW_100K IPC_1K IPC_10K IPC_100K School of ECE, Peking University 24

25 PART V: Conclusion School of ECE, Peking University 25

26 Conclusion HybridCuts: decomposition + cutting New observations A new rule set decomposition A hybrid One- + Multi- dimensional cutting Future Works OpenFlow Software-hardware combined, e.g., FPGA Combine with TCAM School of ECE, Peking University 26

27 Thank you! Web: