Jacking-up the Internet Architecture by separating Location and Identity

Transcription

1 Jacking-up the Internet Architecture by separating Location and Identity Luigi Iannone Senior Research Scientist Deutsche Telekom Laboratories

2 Road Map Why we need a new Internet Architecture? How Loc/ID Split works? Ok, let s split it, but what s the gain? How to modify the stack of a software router? 2

3 Road Map Why we need a new Internet Architecture? How Loc/ID Split works? Ok, let s split it, but what s the gain? How to modify the stack of a software router? 3

4 Internet s Scaling Issues It is commonly recognized that today s Internet routing and addressing system is facing serious scaling problems. D. Meyer, L. Zhang, K. Fall, Report from IAB Workshop on Routing and Addressing, RFC 4984, IETF, September

5 BGP s FIB inflation Active BGP Entries (FIB) Jan-94 to 14-March-11 Source: AS6447 (Oregon) IPv4 IPv Year Cause of BGP Forwarding Information Base (FIB) Explosion: PI (Provider Independent) prefix assignment Multi-homing Traffic-Engineering Security... 5

6 Stable Core exposed to Dynamic Edge Source: Peak Prefix Update Rate per Second IPv6 Peak Prefix Update Rate per Second IPv4 BGP Update Churn Growing slower than FIB s size Can have peaks of thousands per seconds Increases need processing power 6

7 PA vs. PI Addresses Provider Aggregatable Addresses Provider Independent Addresses G /16 G / /24 D B Provider /16 D B Provider /16 E A /24 Customer A /24 Customer 7

8 Multi-Homing /16 G / / /24 G /24 (with Prepending) D Provider /16 E Backup Provider D Provider /16 E Backup Provider B F B F A /24 Customer A /24 Customer /24 (with Prepending) 8

9 Traffic-Engineering (e.g., load balancing) B F B F / / / / / /17 A C A C 9

10 Some other reasons Security: Remember the youtube incident? Big CDNs de-aggregate to avoid prefix hijacking Moore s Law The number of transistors that can be placed inexpensively on an integrated circuit doubles approximately every two years True for high-volume productions, not for low-volume highly specialized hardware like routers Rekhter s Law Addressing can follow topology or topology can follow addressing. Choose one. Due to: Overloaded IP Address Semantic The single connection design of the Internet 10

11 Is the Sky falling? Active BGP Entries (FIB) Jan-94 to 14-March-11 Source: AS6447 (Oregon) IPv4 IPv6 Let s be clear: There is no hard scaling limit We need: Year Improve Scalability Reduce OpEx (make a cheaper Internet) 11

12 Road Map Why we need a new Internet Architecture? How Loc/ID Split works? Ok, let s split it, but what s the gain? How to modify the stack of a software router? 12

13 After more than two years of discussion at the IRTF (Internet Research Task Force)... Along with a plethora of proposals: The Research Group has rough consensus that separating identity from location is desirable and technically feasible. However, the Research Group does NOT have consensus on the best engineering approach to such an identity/location split. LISP Routing Architecture for the Next Generation Internet (RANGI) Internet Vastly Improved Plumbing (Ivip) Hierarchical IPv4 Framework (hipv4) Name Overlay (NOL) Service for Scalable Internet Routing Compact Routing in a Locator Identifier Mapping System (CRM) Layered Mapping System (LMS) Two-Phased Mapping Global Locator, Local Locator, and Identifier Split (GLI-Split) Tunneled Inter-Domain Routing (TIDR) Identifier-Locator Network Protocol (ILNP) Enhanced Efficiency of Mapping Distribution protocols in Map-and-Encap Schemes (EEMDP) Evolution Name-Based Sockets Routing and Addressing in Networks with Global Enterprise Recursion (IRON-RANGER) Hierarchical Architecture for Internet Routing (HAIR) From RFC 6115: Recommendation for a Routing Architecture 13

14 Is it a new idea? Not really it has been around for a while (early 90s and may be even before) J. Saltzer, On the Naming and Binding of Network Destinations, RFC 1498, IETF Network Working Group, August R. Hiden, New Scheme for Internet Routing and Addressing (ENCAPS) for IPNG, RFC 1955, IETF Network Working Group, June M. O Dell, GSE An Alternate Addressing Architecture for IPv6, Internet Draft draft-ietf-ipngwggseaddr-00.txt, IETF Network Working Group, February N. Chiappa, Endpoints and Endpoint Names: A Proposed Enhancement to the Internet Architecture, Available from: < More recent work also use the same idea for different purposes: R. Moskowitz, P. Nikander, Host Identity Protocol (HIP) Architecture, RFC 4423, IETF Network Working Group, May E. Nordmark, M. Bagnulo, Shim6: Level 3 Multihoming Shim Protocol for IPv6, Standards Track RFC 5533, IETF Network Working Group, June

15 Split Locators and Identifiers with Map & Encap AS j Internet AS w RLOC 2 EIDx RLOC 1 EIDy AS z AS k ASx ASy RLOC 1 EIDx RLOC 2 EIDy EIDx RLOC 2 RLOC 2 EIDx EIDy EIDx EIDy Bindings between ID and Locators: Mappings EIDx RLOC 1 RLOC 2 EIDx EIDx EIDy EIDy RLOC 1 EIDy RLOC 2 EIDy 15

16 LISP? Locator Nothing to do with LISP the programming language. ID Separation Protocol. well if you interpret parenthesis as a level of encapsulation then LISP is: (IP (UDP (LISP (IP (Original Transport Level Packet))))) 16

17 LISP Protocol Details: Sending Side LISP-Database: DB Contains mappings owned locally Used to select source RLOC EID s P refix RLOCEID 1 s, RLOCEID 2 s / Version IHL Type of Service Total Length / Identification Flags Fragment Offset OH Time to Live Protocol = 17 Header Checksum Source Routing Locator \ ? \ Destination Routing Locator / Source Port = xxxx Dest Port = 4341 UDP \ UDP Length UDP Checksum L / N L E V I Flags Nonce/Map-Version I S \ Instance ID/ Locator Status Bits P / Version IHL Type of Service Total Length / Identification Flags Fragment Offset IH Time to Live Protocol Header Checksum Source EID \ \ Destination EID

18 Where does LISP find the Mappings? Where is located EID d? DB EID d P refix RLOCEID 1 d, RLOCEID 2 d Mapping Distribution System (ALT, CONS, EMACS, DHT, NERD, TREE) Mapping Distribution System: Queried to retrieve mappings Used to select Destination RLOC 18

19 Where does LISP Store the Mappings? LISP-Cache: DB Cache Queried before the Mapping system Mapping system queried only in case of miss Used to select Destination RLOC Mapping Distribution System (ALT, CONS, EMACS, DHT, NERD, TREE) 19

20 LISP Protocol Details: Receiver Side / Version IHL Type of Service Total Length / Identification Flags Fragment Offset OH Time to Live Protocol = 17 Header Checksum Source Routing Locator \ \ Destination Routing Locator / Source Port = xxxx Dest Port = 4341 UDP \ UDP Length UDP Checksum L / N L E V I Flags Nonce/Map-Version I S \ Instance ID/ Locator Status Bits P / Version IHL Type of Service Total Length / Identification Flags Fragment Offset IH Time to Live Protocol Header Checksum Source EID \ \ Destination EID Consistency Checks: Check DB: Am I the correct RLOC for the destination EID? 20

21 Few words on Mapping Systems Existing LISP Related Mapping Distribution Protocols: Mapping System LISP-NERD Not so novel EID-to-RLOC Database LISP-CONS Content distribution Overlay Network Service LISP-EMACS EID Mapping multicast Across Cooperating Systems LISP-ALT LISP ALternative Topology LISP-DHT LISP Distributed Hash Table LISP-TREE DNS-Based lookup infrastructure Distribution Model Push Hybrid Push/Pull Propagated Information Entire Mapping Database Aggregation No Sensitive to Churn No (updates on a fixed time schedule) EID-Prefix Yes Yes Pull - No No Hybrid Push/Pull EID-Prefix Yes Yes Pull EID-Prefix No No Pull EID-Prefix Yes No 21

22 Road Map Why we need a new Internet Architecture? How Loc/ID Split works? Ok, let s split it, but what s the gain? How to modify the stack of a software router? 22

23 What do we gain with this split? FIB: shrunk since stab AS do not inject anything in the DFZ PI Addresses: Just a matter of changing RLOCs Multi-Homing: Just a list of RLOCs TE: Just a matter of giving priorities to RLOCs Churn: Flapping Edge AS are not anymore in the DFZ Additional Benefits: Mobility Support Path Diversity 23

24 How much Path-Diversity do we gain? Number of destination prefixes prefixes 30 k 25 k 20 k 15 k 10 k 5 k Using BGP routes Using LISP Routeviews Dataset Simulations of Multihomed ASes 0 k Number Number of available of paths Dataset Routes Peers Pairs M-h Stubs M-h Prefixes Routeviews 5,750, This work has been carried out in collaboration with B. Quoitin INL - UCLouvain 24

25 How Traffic Engineering is improved? IDIPS: Path Selection Service Allows evaluating paths from both network and business perspectives LISP: Inter-domain Tunneling Service Allows easy and lightweight traffic differentiation LISP + IDIPS: Flexible inter-domain TE This work has been carried out in collaboration with D. Saucez INL - UCLouvain in the framework of the AGAVE Project 25

26 How much can we reduce the FIB? P(X)>x Simulations Synthetic topologies generated with GHITTLE Hierarchical with business relationship ASes Number of FIB entries (logscale) This work has been carried out in collaboration with B. Quoitin INL - UCLouvain 26

27 Large Scale LISP Evaluation iplane BGP Prex Database PCAP Traces Preprocessing pcap2lisp LISP Traces LISP Database LISP Cache LISP Emulation Based on PCAP Traces Used BGP Granularity for mappings J. Kim, L. Iannone, and A. Feldmann, A Deep Dive into the LISP Cache and What ISPs Should Know about It, in the 10th IFIP International Conference on Networking (Networking 11), May

28 Contacted Prefixes Prefixes/Minute 30K 25K 20K 15K 10K 5K Total Bi directional Out In 0 02h 04h 06h 08h 10h 12h 14h 16h 18h 20h 22h 24h 02h Time of day 28

29 Cache Entries for Vanilla LISP Number of entries per minute 100K 90K 80K 70K 60K 50K 40K 30K 20K 10K s timeout 180s timeout 60s timeout 14MB 12MB 10MB 8MB 6MB 4MB 2MB 0 Cache size per minute 02h 04h 06h 08h 10h 12h 14h 16h 18h 20h 22h 24h 02h Time of day 29

30 Hit vs. Miss Ratio Number of hits/misses per minute 10M 1M 100K 10K 1K Hits (60s) Hits (180s) Hits (1800s) Misses (60s) Misses (180s) Misses (1800s) 02h 04h 06h 08h 10h 12h 14h 16h 18h 20h 22h 24h 02h Time of day AUG

31 Entries Lifetime CDF s timeout 180s timeout 1800s timeout Entry lifetime (seconds) 31

32 Will ISPs adopt this technology? BGP RIB ND x BGP RIB Cache BGP RIB MAP Server ND x BGP RIB Cache BGP RIB Cache BGP RIB Mappings Cache BGP RIB Cache BGP RIB MAP Server Mapping Distribution Sytem's Node Main Assumptions: Incentives to adopt LISP is inversely proportional to the number of Entries i.e., entries represent the cost An entry is the information concerning a Prefix Could be a BGP entry Could be a Mapping in the cache Could be an entry in the overall mapping system L. Iannone and T. Levä: Modeling the economics of Loc/ID Split for the Future Internet,Towards the Future Internet Emerging Trends from the European Research, Pages 11-20, ISBN: , IOS Press. May

33 Cost Evolution Formalization Model: D.A. Joseph, J. Chuang, and I. Stoica Modeling the Adoption of new Network Architectures, ACM CoNEXT 2007! Name Description Range CT Total cost for a generic ISP (i.e., the average number of entries stored per-isp) (0 ] C(L B) Cost (i.e., the number of entries stored per-isp) for a Loc/ID Split adopter ISP [0 ] C(B L) Cost (i.e., the number of entries stored per-isp) for a legacy BGP ISP [0 ] XL % of ISPs that are in Loc/ID Split enabled ISPs [0 1] CI % of ISPs necessary to maintain the Connectivity Infrastructure (0 1] α Cache Aggregation Factor (0 1] β Legacy ISP Proxy Aggregation Factor (0 1] γ Connectivity Infrastructure Aggregation Factor (0 1] ω Mapping Distribution System Load Factor [0 1] 33

34 Total Cost Evolution without Mapping System and naive adopters Cost (% entries) Increasing value of (+C I ) % Loc/ID Split Adopters 34

35 Total Cost with Mapping System and naive adopters ~ Cost (% entries) Pull Model Push model 0.2 ~ % Loc/ID Split Adopters 35

36 Road Map Why we need a new Internet Architecture? How Loc/ID Split works? Ok, let s split it, but what s the gain? How to modify the stack of a software router? 36

37 How to implement an open-source LISP Use an open-source OS: FreeBSD Using Virtual Interfaces Drawback: Static address assignment Modify NAT or Firewalls: Drawback: Static rules, API toward the control plane difficult to implement Native implementation: Advantage: Clean Architecture design Answers to: What would a protocol stack look like if LISP (or any other Loc/ID split approach) would be a fundamental piece of the Internet Architecture? 37

38 Design Main Modules: Encap/Decap Mapping Database and Cache Mapping Distribution Protocol Support Mapping Distribution Protocol (Daemon) Mapping Socket: Support for any Mapping distribution protocol Flexible Extensible FreeBSD User Space (Control Plane) FreeBSD Kernel Space (Data Plane) Encap/Decap Routines Mapping Sockets LISP DB + Cache (MapTables) 38

39 LISP DB + LISP Cache = MapTable MapTable is a Radix Tree Two MapTables installed: IPv4 & IPv6 Merges both LISP-Database and LISP-Cache Different tag Search Key: EID-Prefix RLOCs: stored as chained list Ordered by Priority and Weight EIDx-Prefix RLOC 1 x RLOC 2 x EIDy-Prefix RLOC 1 y EIDw-Prefix RLOC 1 w EIDz-Prefix RLOC 1 z RLOC 2 z RLOC 3 z 39

40 Normal protocol stack operation Transport Layer ip_output() ip6_output() Data- Link 40

41 LISP enabled Protocol stack operation lisp_output() lisp6_output() Transport Layer ip_output() ip6_output() Data- Link 41

42 LISP enabled Protocol stack operation lisp_output() lisp6_output() Transport Layer ip_output() ip6_output() Data- Link 42

43 Measurement Setup Protocols: IPv4 IPv6 Scenarios: Routing no LISP stack Routing with LISP stack GRE Tunnel no LISP Stack GRE Tunnel with LISP Stack LISP Tools: Tcpdump (in and out interfaces of Enc & Dec) Iperf (Src & Dst) 43

44 Latency on the Encapsulator Latency (sec) Routing (no lisp stack) Routing (lisp stack) GRE (no lisp stack) GRE (lisp stack) LISP IPv6 IPv4 44

45 Latency on the Decapsulator Latency (sec) Routing (no lisp stack) Routing (lisp stack) GRE (no lisp stack) GRE (lispstack) LISP IPv6 IPv4 45

46 ?? /* */ 46