UNITY
Open Access DepositedTbps-scale Telemetry Traffic Processing and Monitoring using Programmable Data Planes
The high volume of traffic is always a challenging topic. With the explosive growth of cloud services, video streaming, and AI workloads, Tbps-scale traffic has become the norm in modern hyperscale data centers. As 100G and 400G links become standard across core and edge networks, individual switches and routers are increasingly expected to process aggregate traffic exceeding 1 Tbps. Tbps-level traffic is no longer an outlier
it is a baseline reality for today’s high-performance infrastructures, especially in metro and backbone network segments. With such large volume of traffic, attack traffic disrupts end hosts and wastes network bandwidth, yet distinguishing between normal and anomalous traffic in real time is challenging. While prior work based on sketches and aggregation queries can efficiently track heavy-hitter flows, these techniques fail when used to detect low-volume attacks (e.g., scans, slowloris, etc.) where each flow comprises only a few packets that can be easily missed. New technologies such as P4 switches, SmartNICs, and virtualized middle boxes are adding tremendous power to the network data plane. However, appropriately harnessing these heterogeneous processing capabilities remains a major challenge, as their capabilities vary widely. Only by accounting for the strengths and weaknesses of each of these platforms, will we be able to find the proverbial ‘needle-in-the-haystack’ when monitoring large traffic volumes. Each platform—programmable switches, SmartNICs, and end-hosts—offers unique trade-offs in terms of latency, memory capacity, and computational flexibility. Switches, being in-network devices, offer the lowest latency and are increasingly used for monitoring by executing queries at Terabit link rates. However, their limited memory (typically only tens of megabytes) constrains their ability to maintain complex state. SmartNICs, which process traffic after it is forwarded to specific devices, incur moderately higher latency than switches but support more general-purpose computations. They operate at high speeds (e.g., 40–400 Gbps and can include tens of gigabytes of memory, making them well-suited to complement the coarse-grained capabilities of switches. Finally, end-hosts provide the most flexible programming model and the largest memory capacity, enabling long-term state storage and sophisticated analysis. Yet, they often become a performance bottleneck when analyzing large volumes of packets due to higher processing latency. This thesis demonstrates how to combine the scalability of programmable switches, the reasonably high-speed packet processing of SmartNICs, and the flexible processing capabilities and large storage capacity of host-based systems. First, we propose an efficient data structure for programmable switches that achieves low false positive and false negative rates. We then evaluate this data structure under different eviction policies to meet different design requirements while reducing pipeline recirculations. In addition, we propose an efficient architecture that combines P4 switches, SmartNICs, and end hosts to enable line rate processing and monitoring.
- All rights reserved
Notice to Authors
If you are the author of this work and you have any questions about the information on this page, please use the Contact form to get in touch with us.