Using Packet Histories to Troubleshoot Networks

USING PACKET HISTORIES TO TROUBLESHOOT NETWORKS

Presented by: Yi GaoEmnets Seminar2014-4-6

Operating Networks is Hard• Existing network troubleshooting tools

• traceroute, ping, SNMP, NetFlow, sFlow, …• We are still far from an era of automated troubleshooting

• What we want to ask the network

Packet History• The route a packet takes through a network plus the switch state and header modifications it encounters at each hop

Basic Idea• Send a control message (postcard) at each hop• In each postcard

• A copy of the packet header• The switch ID• The output ports• A version number for the switch forwarding state

• Collect and analyze postcards at a server

NetSight Architecture

Outline• Life of a postcard• History assembly• Postcard compression• Use packet histories• Evaluation

Life of a Postcard

Life of a Postcard (Cnt.)• Step 1:

• From switch to server

Life of a Postcard (Cnt.)• Step 2:

• From servers to servers

Life of a Postcard (Cnt.)• Step 3:

• From servers to disks

History Assembly• Step 3 in the life of a postcard• From multiple postcards to assemble a packet history, in case of reordering

• Solution • Packet ID hash• Topological sort

Postcard Compression• Step 2&3 in the life of a postcard• In step 2: Intra-flow compression• In step 3: Inter-flow compression

Use Packet Histories• Packet history filter• Applications

• ndb• netwatch• netshark• nprof

Use Packet Histories - PF• Postcard Filters (PF)

• A filter to match a packet at a hop (a postcard)

• A PF for a packet with source IP A, entering switch S at any input port other than port P

Use Packet Histories - PHF• Packet History Filter (PHF)

• To express interest in packet histories

• Let X be a PF• start at X: ^{{X}}• end at X: {{X}}$• go through X: {{X}}

Use Packet Histories - Applications• Network Profiler

• Profile a particular link• {{--dpid X --outport p}}

• Reachability Error• a PHF to specify packets from A destined for B that

never reach the intended final hop• ^{{--bpf "ip src A and dst B" --dpid X --inport p1}}[^{{--

dpid Y --outport p2}}]*$

Evaluation – PHF matching latency

Evaluation - Overhead

• Without compression• 31%

• With compression• 3% ~ 7%

Summary• Language

• Packet History Filter concisely represents packet histories of interest

• Applications• A suite of network diagnosis apps built atop the

NetSight API• Platform

• The design, implementation, and evaluation of NetSight

Thanks!