The Need for Complex Analytics from Forwarding Pipelines
Download as PPTX, PDF0 likes567 views
The document discusses the need for complex, real-time analytics in networking, highlighting gaps in observability and proposing a software-defined networking (SDN) based solution that leverages programmable network interface cards (NICs). It emphasizes the importance of dynamic instrumentation for root cause analysis and scalable data monitoring in order to enhance network performance and efficiency. The document calls for collaboration to develop use cases for a new dynamic analytics platform.
The Need for Complex Analytics from Forwarding Pipelines
- 1. The Need for Complex Analytics from Forwarding Pip Tom Tofigh, AT&T Nic Viljoen, Netronome Bryan Sullivan, AT&T
- 2. • Problem Statement • Gaps in Real Time Observability • Proposed SDN Based Observability • Importance of Real-time Programmable Analytics • Data Plane Programmability for Complex Analytics • Programmable NIC Cards • Summary 2 Agenda
- 3. • Require real time observability at data plane and control plane level • Require programmable granular systems without the unscalable approach of metering all the data all the time Looking for the Call Drop Reason! Problem Statement
- 4. 4 • Achieve autonomous control through programmable data plane analytics • Real time dynamic instrumentation-virtual probes that gather trend data • Targets specific flows, SOC/SmartNICs, VMs or containers for observation • Enables instant root cause analysis • Provide scalable solutions for fine grained observation Gaps: Dynamic & Real-Time Programmable Analytics
- 5. Autonomous Control System Concept Measure Analyze
- 6. Proposed Evolution for Dynamic Probing
- 7. Dynamic Probe & Measurement Examples QoE • Flow jitter, latency measurement • Packet drop rate • Application analysis • DDoS detection • Deep packet inspection • Stateful flow monitor Customer Care • Custom statistics • Flow tracing • Root cause analysis Optimization • Load estimation • Traffic matrix calculation • Elephant flow identification compile disseminate configurecollect analyze present dynamic P4 query Models Complex analytics Security
- 8. ROADM (Core) Spine Routers Leaf-Spine Fabric Spine Routers Spine Routers Spine Routers Leaf routersLeaf Routers Leaf Routers Leaf RoutersLeaf RoutersLeaf Routers VM VM VM VM OVS VM VM VM GPON (Access) PON OLT MACs Measurement Abstraction Interface Analytics Platform (XOS + Services) Apps Apps Apps Customer Care Security Diagnosis ONOS + XOS SmartNIC ACORD Observability @ L0 – L7 2.8Tbps
- 9. The SmartNIC Nic Viljoen, Netronome Systems
- 10. The Programmable SmartNIC Challenges with Fixed-Function NICs • Networking applications have diverse requirements • Fixed-function ASICs have “baked-in” functionality and lack flexibility Programmable NIC Advantages • Develop custom networking applications • High performance at network • Preserve CPU cycles • CPU OVS @40Gbps-12 cores • Offload OVS @40Gbps-1 core • Dynamic analytics • High-level languages-P4/C • Examples of SmartNICs: Netronome’s Agilio, Cavium LiquidIO Programmable NIC Architecture “Sea of Workers” for customized networking workloads Support for P4 and Match/Action structures Optimized memory architecture
- 11. vProbe Application • Interpret flow stats and features • Aggregate info to controllers-More on next slide Flow Cache • Keep state for >million flows • Programmable state based on vProbe application requirements • 25G/40G line rate • Programmable payload size/number of flows tradeoff • Self-learning Augmenting Netronome’s Agilio OVS Software for Virtual Probing Compute Node vProbe Application VMVM OVS Userspace Processes (ovs-dbserver, ovs-vswitchd) Action Arguments Linux Kernel Agilio-CX Adapter OVS Datapath Actions Match Tables Controller Tunnels Deliver to Host Update Statistics OVS Datapath Kernel Flow Table, Fallback Path Actions Exact Match Flow Cache Flow Stats and Features Offload Flow Stats and Features Packet Rx/Tx
- 12. vProbe Application • Flow-based data and stat aggregation using techniques such as machine learning • Enables powerful use-cases through use of flow analytics: • Dynamic configuration for DDoS at VM level using high speed clustering/classification algorithms (next slide) • Network shaping based on predictive flow characteristics-Work with University of Arizona has shown 50% improvement in offload utilisation • Elastic VM resource provisioning • Filtering and grouping for analysis at various levels of visibility • Rack, Data Center, Metro, Regional, National Classify Aggregate Analyze React and Configure Cycle Required in < 12s 1 2 3 4 OVS vProbe vProbe OVS
- 13. East/West DDOS Use Case Per VM egress clustering Drop traffic (targeted/all), Reduce VM resources, Shut down VM• E/W DDoS attacks are prevalent • Use vProbe to quickly identify infected VMs and react by modifying flow rules or VMs • Policy dictated by higher-level orchestrator • Aggregated data can be disseminated to multiple orchestration levels • Enables distributed response at server/rack/DC/regional levels 1) Classify 2) Aggregate 3) Analyze 4) Configure 1 3 4 2
- 14. •Intelligent network would benefit from programmable switches, NICs and CPU •NIC based offload is essential as CPU power is not scaling at the rate of Network traffic increase •AT&T’s John Donovan estimated our traffic has increased by 150,000% since 2007 •This means offload is essential to negate cost and maintain performance •Flexible offload opens up potential analytics use cases that have previously not been tenable Observability-Intelligence at the Edge
- 15. Overview-What do you need to find a needle OBSERVABILITY the ability to statefully observe connections COMPUTABILITY the ability to monitor and aggregate complex data in real time FLEXIBILITY the ability to create a real time feedback loop using dynamic data plane and control functions
- 16. With Dynamic Programmable vProbe
- 17. •We are looking to gather a list of use cases for a dynamic analytics platform currently being developed •Email: Tom Tofigh (Tofigh@att.com) or Nic Viljoen (nick.viljoen@netronome.com)-email address with an k! •Join us for the next series of POCs Thank You! Call to Action-We Need Your Use Cases!
Editor's Notes
- #2: Separate actual measurement hardware logic from its control and the analysis logic to enable high dynamic on demand probing interface Define a simple abstraction that allows the control logic to program and specify what to measure and where to send the data Measurement controller collects network-wide data and associates it with the network graph Measurement controller can store the data in memory for real time analytics or dump it in a database for off-line analytics Measurement controller provides abstractions and APIs to make it easier to write real time and non real time analytics apps Utilize NFVs as analytics functions for analytics to be in the data plane Think Pure…Abstract Pure… Architect for Abstractions and extensibility of Probes and Sensors Implement open Interfaces and Modularity to enable dynamic Probe instruction Sets Extend P4 to Complex Analytics without compromising purity
- #3: Virtual Probe Observability and Analytics, utilizing a common compilation and abstraction model (Unified Probe Analytic Orchestration) On Demand Flow Monitory/Filtering and QoE measurement DDOS attach Detection Elastic Traffic Management Classification & control
- #4: SDN & NFV have not played the appropriate role on deep observability
- #5: SDN/NFV been focused on virtualizing many network and IT business functions. The emerging platforms consolidates many proprietary network environments into a Open platform based on commodity HW/SW for increased dev-op models
- #7: Observability Abstraction Resource state dissemination/collection Ability to collect state of resources/elements Ability to observe probes adaptively and on Demand Programming abstraction Ability to program traffic forwarding rules/policies Ability to program the Probes Control blocks Configuration abstraction Ability to configure the resources bases on policies Ability to configure the appropriate Probes for real time needs
- #11: Modern Analytics require a dynamic and programmable underlay of capturing data (probes) High level languages such as P4 and Match/Action structures allow for the creation of such rule based environments Doing this using CPUs consumes too much of the CPU limiting the number of VMs that can be deployed per server (for Applications or VNFs) This meant that network analytics were limited by CPU processing at the edge and too much bandwidth at the switches. SmartNICs can aid this process greatly: More programmable, more flexible and more performant SmartNICs include: Fully programmble solutions Netronome Agilio 10, 25, 40, 100 Gbps solutions, Cavium LiquidIO and configurable solutions from Intel and others This opportunity allows the definition of new dynamic analytics within the SmartNIC to improve network monitoring FIXED FUNCTION CHARACTERISTICS Functionality “baked-in” to silicon. Good if it implements exactly what you need. Bad if it doesn’t. Some Pipelines are more configurable but not fully flexible PROGRAMMABLE CHARACTERISTICS Packets processed by “sea of workers”- threaded architectures with multi/many core configuration Optimized memory architecture for the application High-bandwidth on-chip switch-fabric links memories and workers Many core solutions such as Netronome can scale to very high processing levels
- #12: Allows lightweight, fast monitoring by utilising the Netronome Flow Cache’s flexibility to store observations Flow cache is programmable and flexible, stores a minimum of 250K flows with 1KB of stats each using built in 2GB of DRAM (Agilio-CX) The vProbe app must interpret the flow stats and features, react and send aggregated information to rack level controllers
- #13: Fast aggregation, classification and filtering in under 2s required to achieve aim of <15s analytics