netsight-ppt

USING PACKET HISTORIES TO
TROUBLESHOOT NETWORKS
Presented by: Yi Gao
Emnets Seminar
2014-4-6
Operating Networks is Hard
• Existing network troubleshooting tools
• traceroute, ping, SNMP, NetFlow, sFlow, …
• We are still far from an era of automated
troubleshooting
• What we want to ask the network
Packet History
• The route a packet takes through a network plus
the switch state and header modifications it
encounters at each hop
Basic Idea
• Send a control message (postcard) at each hop
• In each postcard
• A copy of the packet header
• The switch ID
• The output ports
• A version number for the switch forwarding state
• Collect and analyze postcards at a server
NetSight Architecture
Outline
• Life of a postcard
• History assembly
• Postcard compression
• Use packet histories
• Evaluation
Life of a Postcard
Life of a Postcard (Cnt.)
• Step 1:
• From switch to server
Life of a Postcard (Cnt.)
• Step 2:
• From servers to servers
Life of a Postcard (Cnt.)
• Step 3:
• From servers to disks
History Assembly
• Step 3 in the life of a postcard
• From multiple postcards to assemble a packet
history, in case of reordering
• Solution
• Packet ID hash
• Topological sort
Postcard Compression
• Step 2&3 in the life of a postcard
• In step 2: Intra-flow compression
• In step 3: Inter-flow compression
Use Packet Histories
• Packet history filter
• Applications
• ndb
• netwatch
• netshark
• nprof
Use Packet Histories - PF
• Postcard Filters (PF)
• A filter to match a packet at a hop (a postcard)
• A PF for a packet with source IP A, entering
switch S at any input port other than port P
Use Packet Histories - PHF
• Packet History Filter (PHF)
• To express interest in packet histories
• Let X be a PF
• start at X: ^{{X}}
• end at X: {{X}}$
• go through X: {{X}}
Use Packet Histories - Applications
• Network Profiler
• Profile a particular link
• {{--dpid X --outport p}}
• Reachability Error
• a PHF to specify packets from A destined for B that
never reach the intended final hop
• ^{{--bpf "ip src A and dst B" --dpid X --inport p1}}[^{{-dpid Y --outport p2}}]*$
Evaluation – PHF matching latency
Evaluation - Overhead
• Without compression
• 31%
• With compression
• 3% ~ 7%
Summary
• Language
• Packet History Filter concisely represents packet
histories of interest
• Applications
• A suite of network diagnosis apps built atop the
NetSight API
• Platform
• The design, implementation, and evaluation of NetSight
Thanks!