Data Plane Verification and Anteater
|
|
|
- Marilynn Willis
- 6 years ago
- Views:
Transcription
1 Data Plane Verification and Anteater Brighten Godfrey University of Illinois Work with Haohui Mai, Ahmed Khurshid, Rachit Agarwal, Matthew Caesar, and Sam King Summer School on Formal Methods and Networks Cornell University, June 11, 2013
2 Data Plane Verification
3 Managing networks is challenging Production networks are complex Security policies Traffic engineering Legacy devices Protocol inter-dependencies Even well-managed networks have downtime & security vulnerabilities Few good tools to ensure all networking components working together correctly
4 A real example from UIUC Previously, an intrusion detection and prevention (IDP) device inspected all traffic to/from dorms dorm IDP IDP couldn t handle load; added bypass IDP only inspected traffic between dorm and campus Seemingly simple changes How do you know if it worked? bypass Backbone
5 Understanding your network Flow monitoring Screenshot from Scrutinizer NetFlow & sflow analyzer, snmp.co.uk/scrutinizer/ Configuration verification
6 Past approach: Config. verification e.g.: RCC for BGP [Feamster & Balakrishnan, NSDI 05] Margrave for firewalls [Nelson, Barratt, Dougherty, Fisler, Krishnamurthi, LISA 10] UCLA+MSR [in progress...] Configuration Control plane Data plane state Network behavior Input Predicted
7 Data plane verification Our approach: Verify the network as close as possible to its actual behavior Configuration Control plane Data plane state Input Network behavior Predicted
8 Data plane verification Our approach: Verify the network as close as possible to its actual behavior Configuration Control plane Data plane state Input Simpler, unified analysis across control protocols Catch bugs in control software Checks current snapshot Network behavior Predicted
9 Architecture overview Operator Diagnosis 2 Invariants from library or custom Confirmation of correctness, or violated invariants & counterexamples (vulnerabilities) 4 Veriflow Network Verification Layer Construct formal model of network behavior Check queried invariants against model 3 Snapshot or real-time stream of: 1 Topology Data plane state (forwarding tables) Network Routers, switches, firewalls,...
10 Architecture overview Operator Diagnosis 2 Invariants from library or custom Confirmation of correctness, or violated invariants & counterexamples (vulnerabilities) 4 Veriflow Network Verification Layer Construct formal model of network behavior Check queried invariants against model 3 Snapshot or real-time stream of: 1 Topology Data plane state (forwarding tables) Network Routers, switches, firewalls,...
11 Architecture overview Operator Diagnosis 2 Invariants from library or custom Confirmation of correctness, or violated invariants & counterexamples (vulnerabilities) 4 Veriflow Network Verification Layer Construct formal model of network behavior Check queried invariants against model 3 Snapshot or real-time stream of: 1 Topology Data plane state (forwarding tables) Network Routers, switches, firewalls,...
12 Architecture overview Operator Diagnosis 2 Invariants from library or custom Confirmation of correctness, or violated invariants & counterexamples (vulnerabilities) 4 Veriflow Network Verification Layer Construct formal model of network behavior Check queried invariants against model 3 Snapshot or real-time stream of: 1 Topology Data plane state (forwarding tables) Network Routers, switches, firewalls,...
13 Control software bugs 78 bugs sampled randomly from Bugzilla repository of Quagga (open source software router) 67 could cause data plane effect Under heavy load, Quagga fails to update Linux kernel s routing tables In Quagga , a BGP session could remain active after it has been shut down 11 would not affect data plane Mgmt. terminal hangs in Quagga on show ip bgp
14 Q: Where does SDN fit in? Unified data plane interface Helpful, but not absolutely necessary Centralized control of network Critical for real time verification
15 Our Two Tools Anteater [Mai, Khurshid, Agarwal, Caesar, Godfrey, King, SIGCOMM 2011] Offline verification of data plane Veriflow [Khurshid, Zhou, Caesar, Godfrey, HotSDN 2012] [Khurshid, Zou, Zhou, Caesar, Godfrey, NSDI 2013] Online real-time verification of data plane Interoperates with OpenFlow controller
16 Anteater
17 Modeling the network is nontrivial What if only longest prefix match rules on one field?
18 Modeling the network is nontrivial What if only longest prefix match rules on one field?
19 Modeling the network is nontrivial What if only longest prefix match rules on one field? # equivalence classes 2 #rules
20 Modeling the network is nontrivial What if only longest prefix match rules on one field? easy: reachability is polynomial time Add one-bit packet filters: if p[43] = 0 then drop reachability is NP-complete p[4] = 1 p[7] = 1 p[1] = 0 (x 4 _ x 7 _ x 1 ) ^ (...) ^ (...) ^ (...)
21 Modeling the network is nontrivial What if only longest prefix match rules on one field? easy: reachability is polynomial time Add one-bit packet filters: if p[43] = 0 then drop reachability is NP-complete Add packet header transformations... even harder (depends on assumptions, e.g. packet header length bound)
22 Anteater s solution Express data plane and invariants as SAT...up to some max # hops Check with off-the-shelf SAT solver (Boolector)
23 Data plane as boolean functions Define P(u, v) as the policy function for packets Destination Iface traveling from u to v /24 v A packet can flow over (u, v) if and only if it satisfies P(u, v) u v P(u, v) = dst_ip /24
24 Simpler example Destination Iface /0 v u v P(u, v) = true Default routing
25 Some more examples Destination Iface /24 v Drop port 80 to v u P(u, v) = dst_ip /24 dst_port 80 v Packet filtering Destination u Iface /24 v /25 v /24 v P(u, v) = (dst_ip /24 dst_ip /25) dst_ip /24 Longest prefix matching v
26 Reachability as SAT solving Goal: reachability from u to w C = (P(u, v) P(v,w)) is satisfiable u v w A packet that makes P(u,v) P(v,w) true A packet that can flow over (u, v) and (v,w) u can reach w SAT solver determines the satisfiability of C Problem: exponentially many paths - Solution: Dynamic programming (a.k.a. loop unrolling) - Intermediate variables: Can reach x in k hops? - Similar to [Xie, Zhan, Maltz, Zhang, Greenberg, Hjalmtysson, Rexford, INFOCOM 05]
27 Packet transformation Essential to model MPLS, QoS, NAT, etc. u dst_ip /24 v label = 5? w Model the history of packets: vector over time Packet transformation boolean constraints over adjacent packet versions (p i.dst ip /24) ^ (p i+1.label = 5) More generally: p i+1 = f(p i )
28 Invariants Loop detection u w lost Packet loss (black holes) u w Consistency u w u
29 Experience with the UIUC Network
30 Experiences with UIUC network Evaluated Anteater with UIUC campus network 178 routers supporting >70,000 machines Predominantly OSPF, also uses BGP and static routing 1,627 FIB entries per router (mean) State collected using operator s SNMP scripts Revealed 23 bugs with 3 invariants in 2 hours Loop Packet loss Consistency Being fixed Stale config False pos Total alerts
31 Forwarding loops IDP was overloaded, dorm operator introduced bypass IDP IDP only inspected traffic for campus bypass routed campus traffic to IDP through static routes bypass Introduced 9 loops Backbone
32 Bugs found by other invariants Packet loss Consistency u X u Admin. interface Blocking compromised machines at IP level Stale configuration From Sep, 2008 u /24 One router exposed web admin interface in FIB Different policy on private IP address range
33 Refs: Offline Data Plane Verification Static reachability in IP networks [Bush et al 03, Xie et al 05] FlowChecker [Al-Shaer, Al-Haj, SafeConfig 10] ConfigChecker [Al-Shaer, Al-Saleh, SafeConfig 11] Anteater [SIGCOMM 11] Header Space Analysis [Kazemian, Varghese, McKeown, NSDI 12] Abstractions for Network Update [Reitblatt, Foster, Rexford, Schlesinger, Walker, SIGCOMM 12] Verification of Computer Switching Networks: An Overview [Shuyun Zhang, Sharad Malik, Rick McGeer]
34 Looking ahead: An Opportunity Operator Diagnosis 2 Invariants from library or custom Confirmation of correctness, or violated invariants & counterexamples (vulnerabilities) 4 Veriflow Network Verification Layer Construct formal model of network behavior Check queried invariants against model 3 Snapshot or real-time stream of: 1 Topology Data plane state (forwarding tables) Network Routers, switches, firewalls,...
35 Looking ahead: An Opportunity Applications! Real time "knowledge layer" Formal model of network behavior 2 Snapshot or real-time stream of: 1 Topology Data plane state (forwarding tables) Network Routers, switches, firewalls,...
36 Data Plane Verification Discussion 1. Expressing policies can be hard. How can we make network verification easy for operators? 2. What apps can we build on top of a real-time understanding of network s behavior? 3. Can DPV be extended to stateful networks? 4. How should DPV connect with policy generation? 5. Can formal methods dramatically improve network reliability? to: pbg@illinois.edu
Debugging the Data Plane with Anteater
Debugging the Data Plane with Anteater Haohui Mai, Ahmed Khurshid Rachit Agarwal, Matthew Caesar P. Brighten Godfrey, Samuel T. King University of Illinois at Urbana-Champaign Network debugging is challenging
A Hypothesis Testing Framework for Network Security
A Hypothesis Testing Framework for Network Security P. Brighten Godfrey University of Illinois at Urbana-Champaign TSS Seminar, September 15, 2015 Part of the SoS Lablet with David Nicol Kevin Jin Matthew
5 years of research on GENI: From the Future Internet Back to the Present
5 years of research on GENI: From the Future Internet Back to the Present P. Brighten Godfrey University of Illinois at Urbana-Champaign GENI NICE Workshop November 10, 2015 5 years of research on GENI:
Formal Verification of Computer Switch Networks
Formal Verification of Computer Switch Networks Sharad Malik; Department of Electrical Engineering; Princeton Univeristy (with Shuyuan Zhang (Princeton), Rick McGeer (HP Labs)) 1 SDN: So what changes for
Network Verification: From Algorithms to Deployment. Brighten Godfrey Associate Professor, UIUC Co-founder and CTO, Veriflow
Network Verification: From Algorithms to Deployment Brighten Godfrey Associate Professor, UIUC Co-founder and CTO, Veriflow 2nd Hebrew University Networking Summer June 21, 2017 Networks are so complex
VeriFlow: Verifying Network-Wide Invariants in Real Time
VeriFlow: Verifying Network-Wide Invariants in Real Time Ahmed Khurshid, Wenxuan Zhou, Matthew Caesar, P. Brighten Godfrey Department of Computer Science University of Illinois at Urbana-Champaign 201
DIAGNOSE NETWORK FAILURES VIA DATA-PLANE ANALYSIS HAOHUI MAI THESIS
c 2010 Haohui Mai DIAGNOSE NETWORK FAILURES VIA DATA-PLANE ANALYSIS BY HAOHUI MAI THESIS Submitted in partial fulfillment of the requirements for the degree of Master of Science in Computer Science in
Abstractions for Model Checking SDN Controllers. Divjyot Sethi, Srinivas Narayana, Prof. Sharad Malik Princeton University
Abstractions for Model Checking SDN s Divjyot Sethi, Srinivas Narayana, Prof. Sharad Malik Princeton University Traditional Networking Swt 1 Swt 2 Talk OSPF, RIP, BGP, etc. Swt 3 Challenges: - Difficult
Debugging the Data Plane with Anteater
Debugging the Data Plane with Anteater Haohui Mai Ahmed Khurshid Rachit Agarwal Matthew Caesar P. Brighten Godfrey Samuel T. King University of Illinois at Urbana-Champaign {mai4, khurshi1, agarwa16, caesar,
An Assertion Language for Debugging SDN Applications
An Assertion Language for Debugging SDN Applications Ryan Beckett, X. Kelvin Zou, Shuyuan Zhang, Sharad Malik, Jennifer Rexford, and David Walker Princeton University {rbeckett, xuanz, shuyuanz, sharad,
ddnf: An Efficient Data Structure for Header Spaces
ddnf: An Efficient Data Structure for Header Spaces Nikolaj Bjørner 1, Garvit Juniwal 2, Ratul Mahajan 1, Sanjit A. Seshia 2, and George Varghese 3 1 Microsoft Research 2 University of California, Berkeley
Abstraction-Driven Network Verification and Design (a personal odyssey) Geoffrey Xie Naval Postgraduate School
Abstraction-Driven Network Verification and Design (a personal odyssey) Geoffrey Xie Naval Postgraduate School xie@nps.edu It started in 2004 A sabbatical at CMU Joined a collaborative project with AT&T
VeriFlow: Verifying Network-Wide Invariants in Real Time
VeriFlow: Verifying Network-Wide Invariants in Real Time Ahmed Khurshid, Xuan Zou, Wenxuan Zhou, Matthew Caesar, P. Brighten Godfrey University of Illinois at Urbana-Champaign {khurshi1, xuanzou2, wzhou10,
Abstrac(ons for Model Checking SDN Controllers. Divjyot Sethi, Srinivas Narayana, Prof. Sharad Malik Princeton University
Abstrac(ons for Model Checking SDN s Divjyot Sethi, Srinivas Narayana, Prof. Sharad Malik Princeton University Tradi(onal Networking Swt 1 Swt 2 Talk OSPF, RIP, BGP, etc. Swt 3 Challenges: - Difficult
Enabling a Cyber-Resilient and Secure Energy Infrastructure with Software-Defined Networking
Enabling a Cyber-Resilient and Secure Energy Infrastructure with Software-Defined Networking 1 Dong (Kevin) Jin Department of Computer Science Illinois Institute of Technology SoS Lablet/R2 Monthly Meeting,
Enforcing Customizable Consistency Properties in Software-Defined Networks. Wenxuan Zhou, Dong Jin, Jason Croft, Matthew Caesar, Brighten Godfrey
Enforcing Customizable Consistency Properties in Software-Defined Networks Wenxuan Zhou, Dong Jin, Jason Croft, Matthew Caesar, Brighten Godfrey 1 Network changes control applications, changes in traffic
Proceedings of the 2016 Winter Simulation Conference T. M. K. Roeder, P. I. Frazier, R. Szechtman, E. Zhou, T. Huschka, and S. E. Chick, eds.
Proceedings of the 2016 Winter Simulation Conference T. M. K. Roeder, P. I. Frazier, R. Szechtman, E. Zhou, T. Huschka, and S. E. Chick, eds. CONVENUS: CONGESTION VERIFICATION OF NETWORK UPDATES IN SOFTWARE-DEFINED
A fast method of verifying network routing with back-trace header space analysis
A fast method of verifying network routing with back-trace header space analysis Toshio Tonouchi Satoshi Yamazaki Yutaka Yakuwa Nobuyuki Tomizawa Knowledge Discovery Laboratories, NEC Kanagawa, Japan Abstract
Concise Paper: In-Band Update for Network Routing Policy Migration
Concise Paper: In-Band Update for Network Routing Policy Migration Shuyuan Zhang, Sharad Malik, Sanjai Narain, Laurent Vanbever Princeton University, {shuyuanz, vanbever, sharad@princeton.edu} Applied
Path Inference in Data Center Networks
Path Inference in Data Center Networks Kyriaki Levanti, Vijay Gopalakrishnan, Hyong S. Kim, Seungjoon Lee, Emmanuil Mavrogiorgis,AmanShaikh Carnegie Mellon University AT&T Labs Research I. INTRODUCTION
NETWORK VERIFICATION: WHEN CLARKE MEETS CERF
TOOLS FOR PUBLIC CLOUDS, PRIVATE CLOUDS, ENTERPRISE NETWORKS, ISPs,... NETWORK VERIFICATION: WHEN CLARKE MEETS CERF George Varghese UCLA (with collaborators from CMU, MSR, Stanford, UCLA) 1 Model and Terminology
Middlebox Models in Network Verification Research
Middlebox Models in Network Verification Research Julius Michaelis Advisor: Cornelius Diekmann Seminar Innovative Internettechnologien WS2015 Chair for Network Architectures and Services Fakultät für Informatik,
Network Monitoring using Test Packet Generation
Network Monitoring using Test Packet Generation Madhuram Kabra Modern Education Society s College of Engineering Pune, India Mohammed Sukhsarwala Modern Education Society s College of Engineering Pune,
Network Verification: Reflections from Electronic Design Automation (EDA)
Network Verification: Reflections from Electronic Design Automation (EDA) Sharad Malik Princeton University MSR Faculty Summit: 7/8/2015 $4 Billion EDA industry EDA Consortium $350 Billion Semiconductor
Network Verification Using Atomic Predicates (S. S. Lam) 3/28/2017 1
Network Verification Using Atomic Predicates 1 Difficulty in Managing Large Networks Complexity of network protocols o unexpected protocol interactions o links may be physical or virtual (e.g., point to
Automatic Test Packet Generation
Automatic Test Packet Generation James Hongyi Zeng with Peyman Kazemian, George Varghese, Nick McKeown Stanford University, UCSD, Microsoft Research http://eastzone.github.com/atpg/ CoNEXT 2012, Nice,
New Directions for Network Verification
New Directions for Network Verification Aurojit Panda 1, Katerina Argyraki 2, Mooly Sagiv 3, Michael Schapira 4, and Scott Shenker 5 1 UC Berkeley 2 EPFL 3 Tel Aviv University 4 Hebrew University of Jerusalem
On the Complexity of Verifying Stateful Networks. A. Panda S. Shenker Y. Velner K. Alpernas A. Rabinovich M. Sagiv
On the Complexity of Verifying Stateful Networks A. Panda S. Shenker Y. Velner K. Alpernas A. Rabinovich M. Sagiv Alice Classical Networking Ted Stevens was right Bob Mallory Trent Networks provide end-to-end
Formal Network Testing
Formal Network Testing Hongyi Zeng, Peyman Kazemian, George Varghese, Nick McKeown {kazemian,hyzeng,nickm}@stanford.edu, Stanford University, Stanford, CA USA varghese@cs.ucsd.edu, UCSD, San Diego and
Design and development of the reactive BGP peering in softwaredefined routing exchanges
Design and development of the reactive BGP peering in softwaredefined routing exchanges LECTURER: HAO-PING LIU ADVISOR: CHU-SING YANG (Email: alen6516@gmail.com) 1 Introduction Traditional network devices
Software Defined Networking
Software Defined Networking Jennifer Rexford COS 461: Computer Networks Lectures: MW 10-10:50am in Architecture N101 http://www.cs.princeton.edu/courses/archive/spr12/cos461/ The Internet: A Remarkable
Stick to the Script: Monitoring The Policy Compliance of SDN Data Plane
Stick to the Script: Monitoring The Policy Compliance of SDN Data Plane Peng Zhang, Hao Li, Chengchen Hu, Liujia Hu, and Lei Xiong Department of Computer Science and Technology, Xi an Jiaotong University
COCONUT: Seamless Scale-out of Network Elements
COCONUT: Seamless Scale-out of Network Elements Soudeh Ghorbani P. Brighten Godfrey University of Illinois at Urbana-Champaign Simple abstractions Firewall Loadbalancer Router Network operating system
Source Address Validation: from the Current Network Architecture to SDN-based Architecture
Source Address Validation: from the Current Network Architecture to SDN-based Architecture Jun Bi Tsinghua University/CERNET GFI 2013 Nov. 20, 2013 1 Content Source Address Validation Architecture (SAVA)
COM-208: Computer Networks - Homework 6
COM-208: Computer Networks - Homework 6. (P22) Suppose you are interested in detecting the number of hosts behind a NAT. You observe that the IP layer stamps an identification number sequentially on each
On the State of the Inter-domain and Intra-domain Routing Security
On the State of the Inter-domain and Intra-domain Routing Security Mingwei Zhang April 19, 2016 Mingwei Zhang Internet Routing Security 1 / 54 Section Internet Routing Security Background Internet Routing
Forwarding Architecture
Forwarding Architecture Brighten Godfrey CS 538 February 14 2018 slides 2010-2018 by Brighten Godfrey unless otherwise noted Building a fast router Partridge: 50 Gb/sec router A fast IP router well, fast
IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 24, NO. 2, APRIL Hongkun Yang, Student Member, IEEE, andsimons.lam, Fellow, IEEE, Fellow, ACM
IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 24, NO. 2, APRIL 2016 887 Real-Time Verification of Network Properties Using Atomic Predicates Hongkun Yang, Student Member, IEEE, andsimons.lam, Fellow, IEEE,
Forwarding Tables Verification through Representative Header Sets
Forwarding Tables Verification through Representative Header Sets Yacine Boufkhad, Ricardo De La Paz, Leonardo Linguaglossa, Fabien Mathieu, Diego Perino, Laurent Viennot To cite this version: Yacine Boufkhad,
ECIT Institute (Est.2003)
ECIT Institute (Est.2003) Research Excellence & Innovation 180 people 4 Queen s University Belfast Research Groups - Digital Communications - High Frequency Electronics - Speech, Imaging and Vision Systems
NEAt: Network Error Auto-Correct
NEAt: Network Error Auto-Correct Wenxuan Zhou Jason Croft Bingzhe Liu Matthew Caesar University of Illinois at Urbana-Champaign {wzhou, croft, bingzhe, caesar}@illinois.edu ABSTRACT Configuring and maintaining
COMP211 Chapter 5 Network Layer: The Control Plane
COMP211 Chapter 5 Network Layer: The Control Plane All material copyright 1996-2016 J.F Kurose and K.W. Ross, All Rights Reserved Computer Networking: A Top Down Approach 7 th edition Jim Kurose, Keith
HEADER SPACE ANALYSIS
HEADER SPACE ANALYSIS Peyman Kazemian (Stanford University) George Varghese (UCSD, Yahoo Labs) Nick McKeown (Stanford University) 1 July 17 th, 2012 Joint Techs 2012 TODAY A typical network is a complex
Network Verification Solvers, Symmetries, Surgeries. Nikolaj Bjørner
Network Verification Solvers, Symmetries, Surgeries Nikolaj Bjørner NetPL, August, 2016 Networking needs: Configuration Sanity/Synthesis, Programming, Provisioning Network Design Automation Z3 Z3 advances:
Compiling Path Queries in Software-Defined Networks
Compiling Path Queries in Software-Defined Networks Srinivas Narayana, Jennifer Rexford and David Walker Princeton University {narayana, jrex, dpw}@cs.princeton.edu ABSTRACT Monitoring the flow of traffic
Theophilus Benson Aditya Akella David A Maltz
Theophilus Benson (tbenson@cs.wisc.edu) Aditya Akella (akella@cs.wisc.edu) David A Maltz (dmaltz@microsoft.com) Intricate logical and physical topologies Diverse network devices Operating on different
National Taiwan University. Software-Defined Networking
Software-Defined Networking Prof. Ai-Chun Pang Graduate Institute of Networking and Multimedia, Dept. of Comp. Sci. and Info. Engr., Email: acpang@csie.ntu.edu.tw http://www.csie.ntu.edu.tw/~acpang June
Verification of Computer Switching Networks: An Overview
Verification of Computer Switching Networks: An Overview Shuyuan Zhang 1, Sharad Malik 1, and Rick McGeer 2 1 Department of Electrical Engineering, Princeton University, Princeton, NJ {shuyuanz,sharad}@princeton.edu
Leveraging SDN Layering to Systema2cally Troubleshoot Networks
Leveraging SDN Layering to Systema2cally Troubleshoot Networks Brandon Heller Colin Sco/ Nick McKeown Sco= Shenker Andreas Wundsam Hongyi Zeng Sam Whitlock Vimalkumar Jeyakumar Nikhil Handigol James McCauley
Exodus: Toward Automatic Migration of Enterprise Network Configurations to SDNs
Exodus: Toward Automatic Migration of Enterprise Network Configurations to SDNs Tim Nelson Andrew D. Ferguson Da Yu Rodrigo Fonseca Shriram Krishnamurthi Brown University {tn, adf, dyu, rfonseca, sk}@cs.brown.edu
Network Behavior Analysis
N E T W O R K O P E R AT I O N S. S I M P L I F I E D. FORWARD ENTERPRISE HIGHLIGHTS Forward Networks is the leader in Intent-based Networking and network assurance to automate the analysis and verification
Computer Science 461 Final Exam May 22, :30-3:30pm
NAME: Login name: Computer Science 461 Final Exam May 22, 2012 1:30-3:30pm This test has seven (7) questions, each worth ten points. Put your name on every page, and write out and sign the Honor Code pledge
Introduction to SDN (Soft ware Defined Net working)
Introduction to SDN (Soft ware Defined Net working) Outline Traditional net workings Net work planes rethought Associate Prof Dr Chaodit Aswakul Net work Research Group Department of Electrical Engineering
Sweet Little Lies: Fake Topologies for Flexible Routing
Sweet Little Lies: Fake Topologies for Flexible Routing Stefano Vissicchio University of Louvain HotNets 27th October 2014 Joint work with Laurent Vanbever (Princeton) and Jennifer Rexford (Princeton)
MPLS, THE BASICS CSE 6067, UIU. Multiprotocol Label Switching
MPLS, THE BASICS CSE 6067, UIU Multiprotocol Label Switching Basic Concepts of MPLS 2 Contents Drawbacks of Traditional IP Forwarding Basic MPLS Concepts MPLS versus IP over ATM Traffic Engineering with
Real-time Verification of Network Properties using Atomic Predicates
Real-time Verification of Network Properties using Atomic Predicates Hongkun Yang and Simon S. Lam Department of Computer Science, The University of Texas at Austin {yanghk, lam}@cs.utexas.edu TR-13-15
Checking Cloud Contracts in Microsoft Azure
Checking Cloud Contracts in Microsoft Azure Nikolaj Bjørner 1 and Karthick Jayaraman 2 1 Microsoft Research nbjorner@microsoft.com 2 Microsoft Azure karjay@microsoft.com Abstract. Cloud Contracts capture
A Balance of Power: Expressive, Analyzable Controller Programming
A Balance of Power: Expressive, Analyzable Controller Programming Daniel J. Dougherty Worcester Polytechnic Institute dd@cs.wpi.edu Tim Nelson Worcester Polytechnic Institute tn@cs.wpi.edu Kathi Fisler
Software Defined Networking
Software Defined Networking Daniel Zappala CS 460 Computer Networking Brigham Young University Proliferation of Middleboxes 2/16 a router that manipulatees traffic rather than just forwarding it NAT rewrite
MPLS Multi-protocol label switching Mario Baldi Politecnico di Torino (Technical University of Torino)
MPLS Multi-protocol label switching Mario Baldi Politecnico di Torino (Technical University of Torino) http://staff.polito.it/mario.baldi MPLS - 1 From MPLS Forum Documents MPLS is the enabling technology
Multi Topology Routing Truman Boyes
Multi Topology Routing Truman Boyes truman@juniper.net Copyright 2008 Juniper Networks, Inc. 1 Traffic Engineering Choices Today: IGP Metric Costing RSVP TE end to end Policy based routing EROs, Offline
Interdomain Routing and Connectivity
Interdomain Routing and Connectivity Brighten Godfrey CS 538 February 28 2018 slides 2010-2018 by Brighten Godfrey unless otherwise noted Routing Choosing paths along which messages will travel from source
Lecture 3: Packet Forwarding
Lecture 3: Packet Forwarding CSE 222A: Computer Communication Networks Alex C. Snoeren Thanks: Nick Feamster & Mike Freedman Lecture 3 Overview Cerf & Kahn discussion The evolution of packet forwarding
I Know What Your Packet Did Last Hop: Using Packet Histories to Troubleshoot Networks.
I Know What Your Packet Did Last Hop: Using Packet Histories to Troubleshoot Networks. Paper by: Nikhil Handigol, Brandon Heller, Vimalkumar Jeyakumar, David Mazières, and Nick McKeown, Stanford University
Inter-Autonomous-System Routing: Border Gateway Protocol
Inter-Autonomous-System Routing: Border Gateway Protocol Antonio Carzaniga Faculty of Informatics University of Lugano June 14, 2005 Outline Hierarchical routing BGP Routing Routing Goal: each router u
Introduction to Segment Routing
Segment Routing (SR) is a flexible, scalable way of doing source routing. Overview of Segment Routing, page 1 How Segment Routing Works, page 2 Examples for Segment Routing, page 3 Benefits of Segment
TheComponentsthatcanBuildFlexibleEfficientSoftwareDefinedNetwork
Global Journal of Computer Science and Technology: E Network, Web & Security Volume 17 Issue 1 Version 1.0 Type: Double Blind Peer Reviewed International Research Journal Publisher: Global Journals Inc.
Checking Beliefs in Dynamic Networks
Nuno P. Lopes Microsoft Research Checking Beliefs in Dynamic Networks Nikolaj Bjørner Microsoft Research George Varghese Microsoft Research Patrice Godefroid Microsoft Research Karthick Jayaraman Microsoft
CS 5114 Network Programming Languages Control Plane. Nate Foster Cornell University Spring 2013
CS 5 Network Programming Languages Control Plane http://www.flickr.com/photos/rofi/0979/ Nate Foster Cornell University Spring 0 Based on lecture notes by Jennifer Rexford and Michael Freedman Announcements
Routing Overview. Information About Routing CHAPTER
21 CHAPTER This chapter describes underlying concepts of how routing behaves within the ASA, and the routing protocols that are supported. This chapter includes the following sections: Information About
A configuration-only approach to shrinking FIBs. Prof Paul Francis (Cornell)
A configuration-only approach to shrinking FIBs Prof Paul Francis (Cornell) 1 Virtual Aggregation An approach to shrinking FIBs (and RIBs) In routers, not in route reflectors Works with legacy routers
Multihoming with BGP and NAT
Eliminating ISP as a single point of failure www.noction.com Table of Contents Introduction 1. R-NAT Configuration 1.1 NAT Configuration 5. ISPs Routers Configuration 3 15 7 7 5.1 ISP-A Configuration 5.2
Software-Defined Networking. Daphné Tuncer Department of Computing Imperial College London (UK)
Software-Defined Networking Daphné Tuncer Department of Computing Imperial College London (UK) dtuncer@ic.ac.uk 25/10/2018 Agenda Part I: Principles of Software-Defined Networking (SDN) 1. Why a lecture
Information About Routing
19 CHAPTER This chapter describes underlying concepts of how routing behaves within the adaptive security appliance, and the routing protocols that are supported. The chapter includes the following sections:,
Finding a Needle in a Haystack: Pinpointing Significant BGP Routing Changes in an IP Network
Finding a Needle in a Haystack: Pinpointing Significant BGP Routing Changes in an IP Network Jian Wu (University of Michigan) Z. Morley Mao (University of Michigan) Jennifer Rexford (Princeton University)
COCO N: CORRECT-BY-CONSTRUCTION NETWORKS USING STEPWISE REFINEMENT
COCO N: CORRECT-BY-CONSTRUCTION NETWORKS USING STEPWISE REFINEMENT Leonid Ryzhyk Nikolaj Bjorner Marco Canini Jean-Baptiste Jeannin Cole Schlesinger Douglas Terry George Varghese RUNNING EXAMPLE: CAMPUS
Network Security: Network Flooding. Seungwon Shin GSIS, KAIST
Network Security: Network Flooding Seungwon Shin GSIS, KAIST Detecting Network Flooding Attacks SYN-cookies Proxy based CAPCHA Ingress/Egress filtering Some examples SYN-cookies Background In a TCP 3-way
Wildcard Compression of Inter-Domain Routing Tables for OpenFlow-Based Software-Defined Networking
c 2014 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising
SDN abstraction and security: a database perspective
June 17, 2016 SoSSDN SDN abstraction and security: a database perspective Anduo Wang * Jason Croft Xueyuan Mei Matthew Caesar Brighten Godfrey * Temple University University of Illinois Urbana-Champaign
5.1 introduction 5.5 The SDN control 5.2 routing protocols plane. Control Message 5.3 intra-as routing in Protocol the Internet
Chapter 5: outline 5.1 introduction 5.5 The SDN control 5.2 routing protocols plane link state 5.6 ICMP: The Internet distance vector Control Message 5.3 intra-as routing in Protocol the Internet t 5.7
Multiprotocol Label Switching (MPLS) on Cisco Routers
Multiprotocol Label Switching (MPLS) on Cisco Routers This document describes commands for configuring and monitoring Multiprotocol Label Switching (MPLS) functionality on Cisco routers and switches. This
Chapter 5 Network Layer: The Control Plane
Chapter 5 Network Layer: The Control Plane A note on the use of these Powerpoint slides: We re making these slides freely available to all (faculty, students, readers). They re in PowerPoint form so you
A Software Toolkit for Visualizing Enterprise Routing Design
A Software Toolkit for Visualizing Enterprise Routing Design Xin Sun, Jinliang Wei, Sanjay G. Rao, and Geoffrey G. Xie School of Electrical and Computer Engineering, Purdue University Department of Computer
Information, Gravity, and Traffic Matrices
Information, Gravity, and Traffic Matrices Yin Zhang, Matthew Roughan, Albert Greenberg, Nick Duffield, David Donoho 1 Problem Have link traffic measurements Want to know demands from source to destination
OperationCheckpoint: SDN Application Control
OperationCheckpoint: SDN Application Control Scott-Hayward, S., Kane, C., & Sezer, S. (2014). OperationCheckpoint: SDN Application Control. In The 22nd IEEE International Conference on Network Protocols
AS Connectedness Based on Multiple Vantage Points and the Resulting Topologies
AS Connectedness Based on Multiple Vantage Points and the Resulting Topologies Steven Fisher University of Nevada, Reno CS 765 Steven Fisher (UNR) CS 765 CS 765 1 / 28 Table of Contents 1 Introduction
The Road to SDN: An Intellectual History of Programmable Networks Network Virtualization and Data Center Networks SDN - Introduction
The Road to SDN: An Intellectual History of Programmable Networks Network Virtualization and Data Center Networks 263-3825-00 SDN - Introduction Qin Yin Fall Semester 2013 1 2 Data, Control, and Planes
Stable Internet Route Selection
Stable Internet Route Selection Brighten Godfrey Matthew Caesar Ian Haken Scott Shenker Ion Stoica UC Berkeley pbg@cs.berkeley.edu NANOG 40 June 6, 2007 BGP instability: trouble control plane data plane
Real-time Blackhole Analysis with Hubble
Real-time Blackhole Analysis with Hubble Ethan Katz-Bassett, Harsha V. Madhyastha, John P. John, Arvind Krishnamurthy, Thomas Anderson University of Washington NANOG 40, June 2007 1 Global Reachability
CSC 4900 Computer Networks: Routing Protocols
CSC 4900 Computer Networks: Routing Protocols Professor Henry Carter Fall 2017 Last Time Link State (LS) versus Distance Vector (DV) algorithms: What are some of the differences? What is an AS? Why do
On Static Reachability Analysis of IP Networks
On Static Reachability Analysis of IP Networks Geoffrey G. Xie, Jibin Zhan, David A. Maltz, Hui Zhang 1 Albert Greenberg, Gisli Hjalmtysson, Jennifer Rexford 2 June 2004 CMU-CS-04-146 School of Computer
arxiv: v1 [cs.ni] 15 Oct 2017
![arxiv: v1 [cs.ni] 15 Oct 2017](/thumbs/83/87521251.jpg "arxiv: v1 [cs.ni] 15 Oct 2017")
Modeling and Analysis of SDN Control Applications using Vector Spaces Mohamed Aslan 1 and Ashraf Matrawy 2 arxiv:1710.05252v1 [cs.ni] 15 Oct 2017 1 Department of Systems and Computer Engineering, Carleton
Bringing SDN to the Internet, one exchange point at the time
Bringing SDN to the Internet, one exchange point at the time Joint work with: Arpit Gupta, Muhammad Shahbaz, Sean P. Donovan, Russ Clark, Brandon Schlinker, E. Katz-Bassett, Nick Feamster, Jennifer Rexford
Extending Dijkstra s Shortest Path Algorithm for Software Defined Networking
Extending Dijkstra s Shortest Path Algorithm for Software Defined Networking Jehn-Ruey Jiang, Hsin-Wen Huang, Ji-Hau Liao, and Szu-Yuan Chen Department of Computer Science and Information Engineering National
A Connectionless Approach to Intra- and Inter-Domain Traffic Engineering
A Connectionless Approach to Intra- and Inter-Domain Traffic Engineering Hema T. Kaur, Shivkumar Kalyanaraman ECSE Department, Rensselaer Polytechnic Institute, Troy, NY-12180 {hema,shivkuma}@networks.ecse.rpi.edu
Software-Defined Networking (SDN)
EPFL Princeton University 2 5 A p r 12 Software-Defined Networking (SDN) Third-party Enables new functionality through mability 2 1 at the risk of bugs 3 Software Faults Will make communication unreliable
Restrictions for DMVPN Dynamic Tunnels Between Spokes. Behind a NAT Device. Finding Feature Information
DMVPN Dynamic Tunnels Between Spokes Behind a NAT Device The DMVPN: Dynamic Tunnels Between Spokes Behind a NAT Device feature allows Next Hop Resolution Protocol (NHRP) spoke-to-spoke tunnels to be built
A Configuration-only Approach to FIB Reduction. Paul Francis Hitesh Ballani, Tuan Cao Cornell
A Configuration-only Approach to FIB Reduction Paul Francis Hitesh Ballani, Tuan Cao Cornell Virtual Aggregation An approach to shrinking FIBs (and RIBs) In interface-card FIB, maybe control-card RIB Works
NetKAT: Semantic Foundations for Networks. Nate Foster Cornell University
NetKAT: Semantic Foundations for Networks Nate Foster Cornell University Team NetKAT Carolyn Anderson Nate Foster Arjun Guha Jean-Baptiste Jeannin Dexter Kozen Cole Schlesinger David Walker Carbon Software-Defined
Programmable BitPipe. Andreas Gladisch VP Convergent Networks and Infrastructure, Telekom Innovation Labs
Programmable BitPipe Andreas Gladisch VP Convergent Networks and Infrastructure, Telekom Innovation Labs 25.10.2012 How do you program a switch / router today? Vendor N SDK and API Vendor 3 Vendor 2 SDK