FleXight: Flexible Information Channel for Software-Defined Networking
Sajad Shirali-Shahreza · TSpace (University of Toronto) · 2018
The idea of separating data-path from control, introduced by Software-Defined Networking (SDN), leads to a major opportunity to revolutionize computer networks. However, the control channel in OpenFlow, the de facto SDN standard in industry and academia, becomes a bottleneck that limits the controller's access to adequate information for complex tasks. Previous attempts to solve this problem either implement such tasks in the data-path or move the controller closer to the switch. In this thesis, we propose a new approach: a flexible information channel for SDN named FleXight that is based on adaptive per-flow sampling. FleXight enables the controller to dynamically balance between the overhead of information collection and the level of detail. The core of FleXight is FleXam, our proposed per-flow sampling extension for OpenFlow that allows the controller to define which packets should be sampled, what parts of the sampled packets should be sent, and where they should be sent to. FleXam can be implemented in data-path with minimal modifications, operate at line rate with minimal overhead, and be used for creating a wide array of applications. We present two case studies of how FleXam can be used to implement network applications: elephant flow detection, and port scan detection. Naive sampling can have unacceptably high overhead. Through theoretical modeling and experimental analysis of real-world network traces, we develop multiple techniques to reduce and control the overhead of sampling in FleXight: dynamically reducing the sample rate of flows as they grow (flow triage), predicting flow completion (expedited eviction), and delaying rule installation for new flows (flow incubation). We present a detailed analysis of how each technique can reduce the overhead, and its effect on the accuracy of the collected information (e.g., flow description, size, and duration). We also present a software-defined firewall platform for home users. It is a showcase of how FleXight enables us to implement complex systems as controller applications (a task that is difficult, if not impossible, with previous solutions) with low overhead and high accuracy. For example, it can detect all horizontal port scanners and identify compromised hosts almost perfectly with only 0.75% network overhead.