Two Dimensional-IP Routing

Transcription

1 Two Dimensional-IP Routing Mingwei Xu Shu Yang Dan Wang Hong Kong Polytechnic University Jianping Wu Abstract Traitional IP networks use single-path routing, an make forwaring ecisions base on estination aress. Source aress has always been ignore uring routing. Lost of source aress makes the traitional routing system inflexible an inefficient. The current network can not satisfy emans of both the network users an the ISP operators. Although many patch-like solutions have been propose to bring the source aress back to the routing system, the unerlying problems of the traitional routing system can not be solve thoroughly. In this paper, we propose Two Dimension-IP Routing (TwoD- IP), which makes forwaring ecisions base on both source an estination aresses. However, combining with source aress, both the forwaring table an routing protocol have to be re-esigne. To overcome the scalability problem, we evise a new forwaring table structure, which achieves wire-spees an consumes less TCAM storage space. To satisfy emans of users an ISPs, we also esign a simple TwoD-IP policy routing protocol. At last, we iscuss the eployment problem of TwoD-IP. I. INTRODUCTION Internet has become one of the most successful communication networks worl-wie, attracting billions of users an creating great number of applications. However, with more users, the Internet faces many challenges. For example: Traffic insie an ISP network is unevenly istribute; Complex network measurement an anomaly etection always annoy the network operators; Multi-path routing is har to be use because of singlepath routing in traitional networks; Flexible traffic management or policy routing is quite ifficult, within estination-base single-path routing; The current Internet makes forwaring ecisions inepenently at each noe accoring to the estination aress of each packet. This simplicity, or ump core principle, of the traitional Internet pushes all complexities to the eges. However, for simplicity, traitional networks over-emphasize on their reachability to estinations, but o not pay much attention to other aspects relate to sources. With the tremenous growing of the Internet, there are increasing emans for ientifying the sources of traffic, e.g., ISPs usually esire to ivert traffic from one customer network to an egress router, rather than the one selecte by the best path selection algorithm of BGP [1]. The absence of source aress ientity in the routing system causes many problems. For example, it is ifficult for malicious traffic from hackers to be filtere, an ifficult for traffic for emergency service to take preceence. To achieve better manageability an flexibility uring routing, we are now eploying Two Dimensional-IP (TwoD- IP) routing. More specifically, the forwaring ecisions of intermeiate routers will be base on both the estination aresses an the source aresses. Packets from ifferent sources towars the same estination may be elivere to ifferent next hops in TwoD-IP routing, rather than the same one that is on the shortest path in traitional routing. With TwoD-IP, the routing system will become more flexible, manageable an reliable. However, the new TwoD-IP routing architecture will cause aitional overheas in both ata an control planes, which can be seen as a trae-off between simplicity an flexibility. In ata plane, storage cost may increase explosively with the aition of one more imension in the forwaring table. In control plane, we nee new routing protocols to control the routing paths from ifferent sources. We evise a new forwaring table structure for TwoD- IP. The new TwoD-IP forwaring table structure uses two separate TCAM tables to store source an estination prefixes, an a larger SRAM array to store the next hop information. When packets arrive, the router first lookups both source an estination aresses in the two TCAMs, an then use the output information to access the SRAM array an obtain the next hop information. Within the new structure, we can almost keep the same spee as the traitional estination-base forwaring table, an also realize a tolerable growth of storage. We esign a policy routing protocol base on extensions of OSPF. It can ivert traffic from a customer network to another egress router rather than a efault one. ISP operators can flexibly use the new protocol to carry out their policies. We have evelope prototypes of the TwoD-IP routers an new protocol on Bit-Engine 12004, an set up small scale tests uner our testbe as well. The results show that TwoD- IP routers can achieve line spees. The policy routing protocol is a simple example of TwoD-IP routing protocol; we can also esign new protocols for other purposes. II. RELATED WORK Due to the important semantic of source aress, recent years see more research on giving sources control over routing. IP (loose/strict) source routing [2], where the route is carrie in the packet, is naturally combine with IP protocol, an allows the sener to take full control of the routing path. However, ue to security reasons [3], source routing is isable in most networks. In aition, source routing hans most control to the en users, which is unfavorable for ISP operators. MPLS [4] is often use to manage traffic per flow. However, ue to the control an management overheas, MPLS raises concern about scaling when the number of label switching paths (LSPs) increases [5]. The more the LSPs, the heavier the system buren [6]. Overlay [7] can also be use. This however, is beyon the network layer. For an ISP, a light-weight, pure IP-base, an more network-controllable solution is esire. There are many other routing schemes that have been combine with source aress lookup, such as policy-base routing (PBR) [8], customer-specific routing [9], user-irecte

2 routing [10], multi-topology routing [11], where traffic flows on user-specific topology [12]. In our paper, we try to esign a routing architecture which is well combine with source aress lookup, an scales in both control an ata planes. At ege routers, CERNET2 (China Eucation an Research Network 2) has eploye SAVI (Source Aress Valiation Improvement) [13], that guarantees that each packet will hol an authenticate source IP aress. Currently, confirme SAVI users are more than 900,000. CERNET2 then ecies to further eploy source IP functionalities in its network. III. ADDING SOURCE ADDRESS TO THE ROUTING SYSTEM In the current Internet routing, only estination aress is use for forwaring ecision making. This funamentally limits the iversity of the functions an services that the Internet routing system can provie. Facing the emans from the users an applications, many proposals [2][14][4][7] provies aitional functions by incluing source aress, explicitly or implicitly, in their ecision making; however, with their own syntax. It is wiely accepte that the routing system toay is less expressive an provies less basic primitive functions. In this paper, we propose to a source aress in the Internet routing system so that routers can make forwaring ecisions base on both the source an the estination aresses. This greatly enriches the semantics the routing system can provie. Some services are illustrate as the following. Example 1, Policy routing: An ISP wants the traffic from source aress A to estination aress B passes by router C. With TwoD-IP routing, routers in network make forwaring ecisions base on estination an source aresses, thus they can recognize packets from A to B, an ivert them to C. Example 2, Traffic engineering with Loa-Balancing: Assume an ISP has four routers with the topology shown in Fig. 1. Assume there are 50 hosts attache to the ingress router a, an each host sens traffic to the server attache to the egress router at 1Mbps. The total traffic eman is 50Mbps. Using current estination-base single-path routing, traffic towars the same estination shoul take the same route. To achieve Min-max link utilization, all traffic will take the route through b an the maximum link utilization is 83.3%. With TwoD-IP routing, router a coul iffer accoring ifferent sources. The optimal istribution is to let traffic of 30 hosts take the route through b, an traffic of the other 20 hosts take the route through c; the maximum link utilization is 50.0% a b c Server Fig. 1: TwoD-IP routing for better traffic istribution Example 3, Diagnosis: In Fig. 2, assume an ISP has four routers. To monitor router b, c an, the ISP sets up a monitor at router a. With estination-base routing, a has to sen two probe packets. one to the estination of c an the other to the estination. With TwoD-IP routing, by ientifying the a b c Fig. 2: TwoD-IP routing for network monitoring Host a b c Fig. 3: TwoD-IP routing for Multi-path source aress from a, b will recognize that these packets are for probing an can forwar them by path (b,), (,c). So that only one probe packet is neee. Example 4, Multi-path Routing: The Internet is overprovisione with links an banwith; it is well-known that the Internet routing can be more efficient with multi-path routing. However, it is not straightforwar for an ISP to support flexible multi-path in a traitional routing system. ISPs have to go over through MPLS or overlay network, both of which bring overheas an complication. It is much simpler given TwoD-IP routing. See the example in Fig. 3, where the network has four routers, a host connecte to router a an sens packets to. With TwoD-IP routing, we can provie multiple paths towars the same estination at the same time. To achieve this, we only nee to let the host own multiple source aresses, e.g., A, B an C. Router a can make forwaring ecisions base on these source aresses (together with the estination aress). For example, a can forwar the packets with source aress A irectly to, the packets with source aress B to b, an the packets with source aress C to c. The benefits from aing source aresses to the routing system is not limite to the above examples. Intrinsically, we enrich the semantics of the entire Internet routing system. IV. OVERVIEW OF TWOD-IP Fig. 4 shows the architecture of our TwoD-IP routing. Similar to the traitional architecture, it is separate into ata plane an control plane. A. Data Plane Control Plane Data Plane Packet Destination Base Routing Lookup Source-Relate Routing!"# '()*+,-*+., $%&# /& : Packet Fig. 4: TwoD-IP Routing Framework Each entry of the TwoD-IP forwaring table is a 3-tuple, i.e., {source aress, estination aress, action}. When a packet arrives at a router, the router checks both estination aress an source aress, an then outputs a corresponing action (e.g., the next hop to be forware). Compare with traitional forwaring table, the forwaring table in TwoD-IP routing can be much larger. If M is the size of source aress space, a straightforwar implementation will result in an increase of an orer of M. We will iscuss a novel architecture to aress this problem in Section V-A.

3 B. Control Plane Traitional routing protocol only exchanges network status information (e.g., network topology). TwoD-IP routing can meet more emans of the network users an ISPs. Therefore, the control plane can be more flexible. The key component is the routing protocols with upates accoring to both topology changes an policy changes. There are two components of the control plane of our TwoD-IP framework: estination-base routing protocols an source-relate routing protocols. Destination-Base Routing Protocol: Traitional estination-base protocols, e.g., IS-IS an OSPF protocols that can run irectly within the new architecture. The objective of these protocols is to provie connectivity services for users to reach the estinations. To provie better connectivity services, estination-base routing protocol shoul respon instantly to the changes of network topology. Source-Relate Routing Protocol: Base on the combination of network status an user emans, we can make better ecisions on routing for either users or ISPs. We will present one in Section V-A. Different routing protocols can coexist, although they nee to be consistent. Source-relate routing protocol shoul respon to the changes of user emans. Depening on the specific user emans, some source-relate routing protocols nee real-time upates, while others o not. C. Key Challenges Many opportunities can be explore, given that the TwoD- IP routing is eploye. To establish TwoD-IP routing, we consier the following main technical challenges. 1) Forwaring Table Design: The immeiate change that TwoD-IP routing brings to the picture is the routing table size. More specifically, the Forwaring Information Base (FIB) will tremenously increase. Note that a first thought might think that the routing table only oubles. But this is not true, as for each estination aress, it may correspon to ifferent source aresses. A straightforwar implementation means the FIB table shoul change from {estination} {action} to {(source aress, estination aress)} {action}. This increases the FIB size for an orer. The practical consequences can be calculate as follows. TCAM storage is 1 million. The current estination aress space is 400,000. If TwoD-IP is use, an even if we only nee to store 100 source prefixes, the total require storage is 40,000,000. This is far beyon a practical level. We solve this problem by proposing a novel FIST storage framework (see Section V). 2) New Source-Relate Protocol: If all routers are equippe with source aress checking functionality, we can esign many source-relate routing protocols for ifferent purposes. Besies working correctly, the new protocols shoul be: Consistent: The protocols must be consistent with estination-base protocol an other source-relate protocols. There must be no loops, an no policy conflicts. Efficiency: The protocol overheas shoul be low, e.g., maintaining minimum states on routers an bringing minimum exchange messages between routers. To illustrate the source-relate protocol, we evelop a simple policy protocol in Section V-B. 3) Incremental Deployment: Deployment is always a ifficult problem for Internet routing systems. For TwoD-IP routing, it can be change within an AS. Nevertheless, an incremental eployment is still greatly neee. The goals can be groupe into three levels: 1) backwar compatiblity, 2) visible gain if only partial routers are eploye, 3) an upgrae sequence that can maximize the gain in each step. We believe 1) an 2) are a must an 3) nees to be greatly favore. We iscuss incremental eployment in Section V-C. V. DESIGN The TwoD-IP esign has three main components: forwaring table, routing protocol, an eployment scheme. We escribe each esign component in turn. A. FIST: Forwaring Table Design We propose a novel forwaring table structure FIST (FIB Structure for TwoD-IP) for our TwoD-IP forwaring table. It achieves fast lookup an small memory space. The key of our esign is a novel separation of TCAM an SRAM. TCAM contributes to fast lookup an SRAM contributes to a larger memory. Overall, our TwoD-IP forwaring table consumes O(N +M) TCAM storage space, where each of N an M is the size of estination an source aress space. Let an s enote the estination an source aresses, p an p s enote the estination an source prefixes. Let a enote an action, more specifically, the next hop. The storage structure shoul have entries of 3-tuple (p,p s,a). Definition 1: Assume a packet with source aress s an estination aress arrives at a router. The estination aress shoul first matchp accoring to the Longest Match First (LMF) rule. Then source aress s shoul match p s accoring to the LMF rule among all the 3-tuple given p is matche. The packet is then forware to the next hop a. Destination Table HHHI HJJI HJHI HHII HJII Source Table J H K L M ; < B B => D DD B? B C C C C D B E F G TDtable ^_`_`_^ ^_`_`_a ^_`_`_b ^_`_`_c [\]UVW N O P Q STUVWXYZV ORNRNRN ORNRNRO ORNRNRP ORNRNRQ efghii Mapping Table Fig. 5: FIST: A forwaring table structure for TwoD-IP The new structure FIST is mae up of two tables store in TCAMs an other two tables store in SRAM (see Fig. 5). One table in TCAM stores the estination prefixes (we call it estination table thereafter), an the other table in TCAM stores the source prefixes (we call it source table thereafter). One table in SRAM is a two imensional table that stores the inexe next hop of each rule in TwoD-IP (we call it TD-table

4 thereafter) an we call each cell in the array TD-cell (or in short cell if no ambiguity). Another table in SRAM stores the mapping relation of inex values an next hops (we call it mapping-table thereafter). For each rule(p,p s,a),p is store in the estination table, an p s is store in the source table. We can obtain a row aress in TD-table through p, an a column aress in TDtable through p s. Combining the row an column aresses, we can access a cell ((p,p s ) is use to enote the cell) in TD-table, an obtain an inex value. Accoring to the inex value, a is store in the corresponing position of mapping table. We store the inex value rather than the next hop a in the TD-table, because next hop information is much longer. For example, in Fig. 5, for rule (100,111, ), 100 is store in estination table an is associate with 1 st row, an 111 is store in source table an associate with 1 st column. In the TD-table, the cell (100, 111 ) corresponing to 1 st column an 1 st row has inex value 2. In the mapping table, the next hop that is relate to inex value 2 is A Packet Arrives Lookup source aress in Source Table jkklmn opqrsturskt uoovpqq st wpqrsturskt xuyzp Column=m Lookup the cell in n{ row, m{ column in TD-table Row=n Inex value = v Lookup v in mapping table Fig. 6: Lookup action in FIST Obtain the next hop information The lookup action lookup(,s) is shown in Fig. 6. When a packet arrives, the router first extracts the source aress s an estination aress. Using the LMF rule, the router fins the matche source an estination prefixes in both source an estination tables that resie in the TCAMs. Accoring to the matche entry, the source table will output a column aress an the estination table will output a row aress. Combine with the row an column aresses, the router can fin a cell in the TD-table, an return an inex value. Using the inex value, the router looks up the mapping table, an returns the next hop that the packet will be forware to. Theorem 1: The look up spee of FIST is one TCAM clock cycle plus three SRAM clock cycles. Proof: Source an estination tables can be accesse in parallel, one TCAM clock cycle is enough. Getting the row an column aress costs one SRAM clock cycle, Accessing TD-table an mapping table costs two SRAM clock cycles. As a comparison, the conventional estination-base routing usually stores estination prefixes in one TCAM, an accesses both TCAM an SRAM once uring a lookup process. Note that the SRAM clock cycle is much smaller than TCAM cycle [15], an the bottleneck of a router normally happens uring elivering packets through the FIFO. Thus two more accesses in SRAM will not have a significant impact on throughput. In the TD-table of FIST, there are cells that o not have inex values, e.g., cell (101,111 ) in Figure 5. We call these cells conflicte cells, i.e., confliction happens when packets match them. To aress the problem, we shoul pre-compute an fill the conflicte cells. For example, we shoul fill (101,111 ) with 2, which is the inex value of (101,11 ). As a proof-of-concept, we implement the FIST forwaring table structure on a commercial router, Bit-Engine Our implementation is base on existing harware, an oes not nee any new harware. We re-esign the harware by rewriting about 1500 lines of VHDL coe (not incluing C coe) of the original estination-base version. The evaluation results show that FIST can achieve line spees. B. PORPT: Routing Protocols Design The TwoD-IP architecture provies great opportunities an flexibility for the ISPs to eploy routing protocols for ifferent purposes. In this section, we esign a policy routing protocol PORPT (Policy Routing Protocol for TwoD-IP), which illustrates a simple example for a TwoD-IP routing protocol. Our goal is to ivert traffic from some specifie customer network to any ege router. For example, in Fig. 7, customer networks are connecte to ISP network through provier ege routers (PE routers, e.g., B 0 an B 1 ), an ISP network is connecte to foreign Internet through ege routers (e.g., E 0, an E 1 ). Besies the PE an ege routers, there are other routers (P routers, e.g., I 0, I 1, I 2, I 3 ) in the network. Currently, traffic from customer networks to the foreign Internet all passes through E 0. The objective of the ISP is to move the traffic from B 1 towars the foreign Internet to E * Domain_Num=0 Domain_Num= * B} B~ Customer Network I~ I} I ISP Network I Fig. 7: Example of policy routing E} E~ * * * Foreign Internet We esign an intra-omain routing protocol combine with OSPF. Aitional information is isseminate an receive through extensions of OSPF [16]. Such that routers can know the preference of customer networks, which can be obtaine through manual configuration or automatic selection. With these conitions, the ege router will announce foreign Internet prefixes information to intra-omain, incluing the ientity of the ege router itself. The PE router will announce its preferences on ege routers, an the bining information between its customer prefixes an customer omain number. The routers of the ISP can compute the TwoD-IP forwaring table base on these information. We first escribe the PORPT protocol etails an then escribe how to transform the information into the two imensional routing table. Let F oreign P ref ix be a foreign Internet prefix, Customer Prefix be a customer prefix, Router ID be the IP aress of a router an Domain Num be the omain number of a customer network. We efine messages as follows. Announce(F oreign P ref ix, Router ID): This message is sent by an ege router ofrouter ID to announce a foreign Internet prefix IP Prefix. Bin(Customer P ref ix, Domain N um): This message is sent by a PE router to announce the bining in-

5 formation between a customer prefix an omain number of this customer network. P ref(domain N um, Router ID): This message is sent by a PE router, to announce the preference for a customer network on an ege router. Time ƒ ƒ ƒ ƒ ˆ ƒ ƒ Š Œ Ž š œ œ žÿ Ž Ž Š Œ Ž š œ œ žÿ Œ Ÿ ŽŒ š Œ Ÿ ŽŒ Ž Š Œ Ž Ž Š Œ Ž š œ œ žÿ Ž Fig. 8: Time line of the policy routing protocol Fig. 8 shows the time line of PORPT. The ege routers just have to announce the foreign Internet prefixes combine with its own router ientification to intra-omain. The PE routers have to announce the bining between its customer omain number an customer prefixes, PE routers also have to announce the preferences on ege routers. After obtaining the foreign Internet prefixes an preferences of customer networks, both PE an P routers shoul compute the two imensional routing table. For example, in Figure 7, PE router B 0 will announce the bining information by sening Bin(0.0.0., 0), B 1 will announce Bin(0.0.1.,1). Ege router E 0 will announce three foreign Internet prefixes combine with its own ientification by sening Announce(1.0.0.,E 0 ), Announce(1.0.1.,E 0 ), Announce(1.0.2.,E 0 ), E 1 will announce Announce(1.0.0.,E 1 ), Announce(1.0.1.,E 1 ), Announce(1.0.2.,E 1 ). At last, B 1 will announce Pref(1,E 1 ). Receiving these messages, PE an P routers can construct the two imensional routing tables, we show the routing table on router I 0 in Table I. TABLE I: Two imensional routing table on the P router I0 Destination Prefix Source Prefix Next Hop * * I * * I * * I1 We have evelope a prototype of PORPT, set up tests uner VegaNet [17], a high performance virtualize testbe. C. Deployment It is wiely known that making changes to the network layer is notoriously ifficult. We consier two important problems in the eployment. First, uring the eployment, the propose protocols shoul have small impact on the Internet protocols an infrastructure. Secon, at the initial stage, a noe-bynoe incremental eployment scheme is highly preferre to minimize error an support efforts. Currently, we mainly focus on a noe-by-noe incremental eployment scheme. We consier the most important factor for the success is that the eployment shoul have visible benefits after each noe is eploye. We have a separate stuy on this problem [18]. The key investigate problem is that without full eployment, the resulting paths for traffic from some sources may eviate from the require ones, (i.e., pre-efine by users or ISP proviers), then how to fin noe eployment sequences to minimize the eviation. We rigily efine the eviation an mathematically formulate the problem. We evelope several algorithms for ifferent practical scenarios an a case stuy on CERNET2. Our main observation is that we can gain the majority of the performance when only a small percentage of carefully selecte noes are eploye. VI. CONCLUSION AND FUTURE WORK We presente the TwoD-IP architecture, which is closely combine with source aress uring routing. With TwoD-IP, the semantics that the routing system can provie are greatly enriche. There are also great challenges that we shoul face uring esigning an implementing TwoD-IP. In this paper, we escribe our initial esign for TwoD-IP. REFERENCES [1] E. Chen an S. Sangli, Avoi BGP Best Path Transitions from One External to Another, RFC 5004 (Stanars Track), Internet Engineering Task Force, Sep [2] D. Estrin, T. Li, Y. Rekhter, K. Varahan, an D. Zappala, Source Deman Routing: Packet Format an Forwaring Specification (Version 1), RFC 1940 (Informational), Internet Engineering Task Force, May [3] C. Perkins, IP Encapsulation within IP, RFC 2003 (Stanars Track), Internet Engineering Task Force, Oct [4] E. Rosen, A. Viswanathan, an R. Callon, Multiprotocol Label Switching Architecture, RFC 3031 (Stanars Track), Internet Engineering Task Force, Jan [5] S. Yasukawa, A. Farrel, an O. Komolafe, An Analysis of Scaling Issues in MPLS-TE Core Networks, RFC 5439 (Informational), Internet Engineering Task Force, Feb [6] C. Metz, C. Barth, an C. Filsfils, Beyon mpls... less is more, Internet Computing, IEEE, vol. 11, no. 5, pp , Sep [7] D. Anersen, H. Balakrishnan, F. Kaashoek, an R. Morris, Resilient Overlay Networks, in Proc. ACM SOSP 01, Banff, Canaa, October [8] Policy-Base Routing (white paper), Cisco, [9] J. Fu an J. Rexfor, Efficient ip-aress lookup with a share forwaring table for multiple virtual routers, in Proc. ACM CoNEXT 08, Mari, Spain, Dec [10] P. Laskowski, B. Johnson, an J. Chuang, User-irecte routing: from theory, towars practice, in Proc. ACM NetEcon 08, Seattle, WA, USA, Aug [11] N. Wang, K.-H. Ho, an G. Pavlou, Aaptive multi-topology igp base traffic engineering with near-optimal network performance, in Proc. IFIP-TC6 NETWORKING 08, Singapore, May [12] Multi-topology routing (white paper), Juniper, Aug [13] J. Wu, J. Bi, M. Bagnulo, F. Baker, an C. Vogt, Source aress valiation improvement framework, Internet Draft, Mar 2011, raftietf-savi-framework-04.txt. [14] P. Ferguson an D. Senie, Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Aress Spoofing, RFC 2827 (Best Current Practice), Internet Engineering Task Force, May [15] J. Kim, M.-C. Ko, H.-K. Kang, an J. Kim, A hybri ip forwaring engine with high performance an low power, in Proc. ICCSA 09, Seoul, Korea, Jun [16] A. Zinin, A. Roy, L. Nguyen, B. Frieman, an D. Yeung, OSPF Link- Local Signaling, RFC 1940 (Stanars Track), Internet Engineering Task Force, Aug [17] C. Wenlong, X. Mingwei, Y. Yang, L. Qi, an M. Dongchao, Virtual network with high performance: Veganet, Chinese Journal of Computers, vol. 33, no. 1, pp , [18] S. Yang, D. Wang, M. Xu, an J. Wu, Efficient two imensional-ip routing: An incremental eployment esign,, Tech. Rep., July [Online]. Available: