Traic-Aware Placement o NFV Middleboxes Wenrui Ma, Carlos Medina, and Deng Pan School o Computing and Inormation Sciences Florida International University, Miami, FL wma6@iu.edu, cmedi45@iu.edu, pand@iu.edu Abstract Network Function Virtualization (NFV) enables lexible deployment o middleboxes as Virtual Machines (VMs) running on general hardware. Dierent types o middleboxes have the potential to either increase or decrease the volume o processed traic. In this paper, we investigate the traic changing eects o middleboxes, and study eicient deployment o NFV middleboxes in Sotware-Deined Networks (SDNs). To begin with, we ormulate the Traic-Aware Middlebox Placement (TAMP) problem as a graph optimization problem, and show that it is NP-hard when there are multiple lows to consider. Next, by observing that in reality lows arrive one at a time, we leverage the SDN central control mechanism, and propose an optimal solution or the TAMP problem with a single low. We develop the solution in two steps. First, when the low path has been determined, we present the Least-First-Greatest-Last (LFGL) rule to place middleboxes. Second, we integrate the LFGL rule with widest-path routing to propose the LFGL based MinMax routing algorithm. Further, we have implemented the proposed algorithm as a module running on top o the Floodlight SDN controller, and conducted experiments in the Mininet emulation system. The experiment results ully demonstrate the superiority o our algorithm over other benchmark solutions. Index Terms Network Function Virtualization, Sotware- Deined Networking, Traic-Aware Routing I. INTRODUCTION Middleboxes are widely deployed in modern networks. Traditional middleboxes are hardware-based network appliances that implement specialized unctions such as irewalls, VPN proxies, and WAN optimizers. Such hardware middleboxes suer rom a number o drawbacks [], including high cost, unction inlexibility, and diiculty to scale up. With the development o virtualization technology, Network Function Virtualization (NFV) emerges as a promising architecture to evolve middlebox implementations by running network unction sotware on virtualized general hardware. The NFV platorm is usually an o-the-shel server that hosts multiple Virtual Machines (VMs), each VM implementing a middlebox unction with special sotware programs. When packets arrive, they are sorted based on predeined traic processing rules and sent to dierent sotware middleboxes. Dierent rom interconnection network devices such as switches and routers, middleboxes ocus on inspecting and manipulating traic, and thus have the potential to change the volume o processed traic and may do it in dierent ways. For example, a WAN optimizer compresses lows beore sending them to the next hop. On the other hand, a VPN proxy increases traic rates due to IPSec header overhead. Finally, a irewall will keep the traic rates o allowed lows unchanged and reduce the rates o denied lows to zero. For easy description, i a middlebox increases traic rates, we call it an expanding middlebox, and otherwise a shrinking middlebox. The ollowing toy example illustrates the traic changing eects o middleboxes. Consider a network consisting o two switches S and S 2, each with an attached NFV server N and N 2, respectively. Host H and H 2 are connected to S and S 2, respectively, and there is a low between them, whose traic rate is. Two middleboxes m and m 2 need to be applied to. m will double the traic rate, while m 2 will cut the traic rate in hal. Assume that each o the two NFV servers has space to host only one middlebox. I install m on N and m 2 on N 2, the load o link (S, S 2 ) will be 2 = 2, as shown in Fig. (a). However, i install m on N 2 and m on N 2, the link load will be.5 =.5, as shown in Fig. (b). m m 2 2 2 2 H S S 2 H 2 (a) m on S, m 2 on S 2 m 2 m.5.5.5 H S S 2 H 2 (b) m 2 on S, m on S 2 Fig. : Traic changing eects o middleboxes. Previous research on middleboxes has ocused on middlebox virtualization on commodity servers [2] [4], vitualized sotware middlebox platorm [], placement and chaining o middleboxes in SDN networks [5] [7]. To the best o our knowledge, the traic changing eects have not been investigated. In this paper, we study the Traic-Aware Middlebox Placement problem. We consider an enterprise network with NFV servers to host sotware middleboxes. Given a set o lows that need be processed by dierent middleboxes, our objective is to eiciently route the lows and place the middleboxes to achieve optimal network perormance. Our solution leverages the emerging SDN technology [8], and runs as a module on top o the SDN controller. Unlike traditional network architecture, SDN decouples the control
plane and data plane. The control plane makes decisions on where the traic should be sent, and the data plane orwards the traic based on the decisions. Consequently, an SDN network consists o a central controller, i.e., the control plane, and a group o switches, i.e., the orwarding plane. By the OpenFlow protocol, the controller and the switches can communicate with each other. When a low o packets arrive, the controller will set up orwarding rules in switch low tables, by which the switches will orward the packets to either the next hop or the middleboxes running on attached NFV servers. Our main contributions in this paper can be summarized as ollows. First, we ormulate the Traic-Aware Middlebox Placement (TAMP) problem, and show that it is NP-hard when there are multiple lows. Second, we consider the practical scenario where lows arrive one at a time, and develop an optimal solution in two steps. In the irst step, we assume that the low path has been determined, and propose the Least- First-Greatest-Last (LFGL) rule, which sorts all middleboxes based on their traic changing ratios, and places shrinking middleboxes rom the head o the low path and expanding middleboxes rom the tail. In the second step, we propose the LFGL based MinMax routing algorithm, which integrates the LFGL rule with the widest-path routing algorithm, to ind the optimal path that minimizes the maximum link load on the low path. Finally, we implement the proposed algorithm in the open-source Floodlight SDN controller, and build a prototype with the Mininet emulation system. Experiment results under dierent topologies are presented to demonstrate the superiority o our algorithm over other benchmark solutions. The remainder o the paper is organized as ollows. Section II ormulates the problem. Section III develops the proposed algorithm in two steps. Section IV presents the experiment results. Finally, Section V concludes the paper. II. PROBLEM FORMULATION In this section, we ormulate the Traic-Aware Middlebox Placement (TAMP) problem. Consider a network represented by a directed graph G = (H V, E), where H, V, and E are the set o hosts, switches, and links, respectively. A switch u V may have an attached NFV server, and its space capacity is denoted as sc(u), i.e., the number o middleboxes that the NFV sever can host. A link (u, v) E has a bandwidth capacity bc(u, v), i.e., the available bandwidth. Let F denote the collection o lows. A low F is represented as a 4-tuple (s, d, t s, M ) in which s H is the source host, d H is the destination host, t s is the initial traic rate when leaves s, and M is the set o middleboxes that need to be installed or. Use t (u, v) to represent the traic rate o on link (u, v). Speciically, t (pre(u), u) denotes the traic rate on the preceding link o u, where u V is a switch on the path o and pre(u) is the preceding node on the path; t (u, post(u)) denotes the traic rate on the succeeding link, where post(u) is the succeeding node o u V. Denote a middlebox by m M, which is deined as a pair (a m, k m ), where a m is the associated processing action, and k m is the traic changing actor, or in other words +k m is the ratio o the traic rate o beore and ater being processed by m. k m and + k m, since the traic rate o a low cannot be negative. For example, i m M is installed on u V, then t (u, post(u)) = t (pre(u), u) ( + k m ). Note that expanding and shrinking middleboxes have positive and non-positive traic changing actors, respectively. When a low enters the network, by the SDN architecture, the controller will select a path or the low. Use the decision variable α to denote the low path as ollows: α u,v = {, i low traverses link (u, v)., otherwise. To avoid perormance degradation or TCP lows, a low is not allowed to be split among two paths. In addition, the controller will select switches to install (on their attached NFV servers) the middleboxes m M. Use the decision variable β to denote the middlebox placement as ollows: { βm u, i middlebox m is installed at node u. =, otherwise. (2) The optimization objective is to identiy a set o α and β so that the maximum link load is minimized in the network, as shown in Equation (3). subject to: () minimize maxlinkload (3) (u, v) E : t (u, v) maxlinkload bc(u, v) (4) F u V, (u, v) E, F : t (u, v) = α u,v t (w, u) ( + βmk u m )(5) w H V m M u V : βm u sc(u) (6) F m M F : α s,u α u,s =, (7) α u,d α d,u = (8) F, m M : βmα u u,v = (9) (u,v) E Equation (4) states that, or a link (u, v), the aggregate traic demand F t (u, v) o all lows is no greater than the maximum link load, and should not exceed its bandwidth capacity bc(u, v). Equation (5) states that, or a link (u, v) on
the path o low, i.e., α u,v =, the traic generated by on this link is the product o the traic on the previous link t (w, u) and the traic changing ratios + k m o all the middleboxes m placed at node u, i.e., βm u =. This equation also guarantees low conservation on each switch on the path. Equation (6) states that, or a switch node u V, the total number o hosted middleboxes F m M βm u should not exceed its space capacity sc(u). Equations (7) and (8) state that low must start at its source s, and end at its destination d. Equation (9) states that a middlebox m M must be installed on one o the switches u on the path o. From the above ormulation, we can see that the known NPhard Multi-Commodity Flow Problem [9] is a special case o the TAMP problem without middleboxes. It can be ormally shown that the TAMP problem is NP-hard by reduction rom the Multi-Commodity Flow Problem. Due to space limitations, the detailed proo is omitted. III. PRACTICAL TRAFFIC-AWARE MIDDLEBOX PLACEMENT In this section, we propose a polynomial-time optimal solution or the TAMP problem when there is a single low, i.e., F =. As seen above, when there are multiple lows, the TAMP problem is NP-hard. Fortunately, in reality, lows tend not to arrive at the exactly same time. Even i multiple lows arrive simultaneously in an SDN network, the controller will have to process them one by one. Thus, our solution or a single low is o practical importance, especially or SDN networks. The ollowing theorem shows that or the TAMP problem with a single low, it is suicient to ind a solution that minimizes the maximum link load on the low path. Theorem. For the Traic-Aware Middlebox Placement problem with a single low, the solution that minimizes maximum link load on the low path achieves the global optimization objective. Proo. For the purpose o contradiction, assume that the solution α, β, i.e., routing and placement, minimizes the maximum link load on the low path, but there exists another solution α, β where α α or β β, that has higher maximum link load on its low path, but lower global maximum link load, i.e., the maximum link load o the entire network instead o the low path. Note that a link should have the same load in the two solutions, unless it is no the low path. We analyze the ollowing three possible scenarios. ) I the link with the global maximum link load o α, β is not on its low path, and neither is that o α, β, then the two solutions should have the same global maximum link load. 2) I the link with the global maximum link load o α, β is on its low path, i.e., equal to its low maximum link load, since α, β has higher low maximum link load, it will have higher global maximum link load as well. 3) I the link with the global maximum link load o α, β is on its low path, i.e., equal to its low maximum link β': β'': s s pre (u) pre (u) m' u m u m u' m' u' Fig. 2: Proo o Theorem 2. post (u') post (u') load, since α, β has lower low maximum link load, it should have lower global maximum link load as well. In either case, the result contradicts the assumption that α, β achieves lower global maximum link load. Next, we develop our solution or a single low in two steps. First, when the low path has been determined, we present the Least-First-Greatest-Last (LFGL) rule. It places shrinking and expanding middleboxes rom the head and tail o the low path, respectively, to minimize the amount o traic entering the network core. Next, we propose the LFGL based MinMax routing algorithm by integrating the LFGL rule with the widest-path routing algorithm. It uses a widestpath like routing algorithm to search the path irst rom the source and then rom the destination, and installs middleboxes simultaneously during the path searching process. A. Least-First-Greatest-Last Placement Rule Assume that or a low, its path has been determined, i.e., α is known. The only remaining task is then to place middleboxes, i.e., to determine β. The LFGL rule irst sorts all the middleboxes m M based on their traic changing actors k m. It then places the middleboxes with non-positive actors or shrinking middleboxes one by one rom the head o the path in an increasing order. When one node has used up its space capacity, LFGL continues with the next node on the path. Ater inishing placing shrinking middleboxes, the rule switches to expanding middleboxes and place them rom the path tail in the decreasing order o their traic changing actors. The deployment succeeds i all middleboxes are placed, and ails otherwise. Due to space limitations, the detailed pseudo code description is omitted. Theorem 2. The Least-First-Greatest-Last rule achieves the optimal link load on the low path. Proo. For the purpose o contradiction, assume that a dierent placement scheme β achieves maximum link load maxlinkload lower than that o LFGL, i.e., maxlinkload < maxlinkload. Without loss o generality, assume that the dierences between the two placement schemes include shrinking middleboxes, and m is the one with the least traic changing actor. By the LFGL rule, m is installed in the irst available node u o its placement time, i.e., β u m =. By comparison, the other placement scheme installed m on a dierent node d d
u, i.e., β u m =, which must be ater u on the low path, and instead a dierent middlebox m is placed on u, i.e., β u m =. Apparently, the placement o m is also dierent in β and β. Since among the dierences between β and β, m has the least traic changing actor, we know that k m k m. Next, as shown in Fig. 2, we create a new placement scheme β by switching the locations o m and m in β, i.e., β v n = β v n, i n m, m β u β u m(= ), i n = m, v = u () m (= ), i n = m, v = u Then, the maximum link load maxlinkload o the new placement β will be less than or equal to that o β, i.e., maxlinkload maxlinkload. Denote the traic rates o on link (u, v) E under β and β as t (u, v) and t (u, v), respectively. Analyze the ollowing three types o links. ) For a link (v, w) between s and u, since the middleboxes placed beore u are the same under β and β, the traic rates o on such a link are also the same under both schemes, i.e., t (v, w) = t (v, w). 2) For a link (v, w) between u and post(u ), since we exchanged the locations o m and m in β, t (v, w) = t (v, w)(k m /k m ). Since k m k m as shown above, we know t (v, w) t (v, w). 3) For a link (v, w) between post(u ) and d, since the middleboxes placed ater u are the same under β and β, the traic rates o on such a link are the same, i.e., t (v, w) = t (v, w). Thus, compared with β, β achieves no higher maximum link load maxlinkload maxlinkload, and it has one less dierence with β generated by LFGL. Continuing this process and eliminating all the dierence between β and β, it can be shown by induction that β achieves no higher maximum link load than that o β, i.e., maxlinkload maxlinkload, which contradicts the assumption. B. LFGL Guided MinMax Routing Next, we propose the LFGL based MinMax routing algorithm. The basic idea is to integrate the LFGL rule with the widest-path routing algorithm to ind the optimal path. Based on the LFGL rule, the algorithm also works in two stages. In the irst stage, the algorithm traverses the network starting rom the low source s, and calculates the path to each nodes that minimizes the maximum link load. When the MinMax path to a node is determined, the algorithm installs shrinking middleboxes on the node until there is no more space. Note that the calculation process may attempt placing middleboxes at dierent nodes with a dierent search path. When all shrinking middleboxes have been placed on each possible searching path, the algorithm switches to process the expanding middleboxes in the next stage. In the second stage, the algorithm traverses the network backwards rom the low destination d, and places expanding middleboxes when the MinMax path to a node is ound. Note that i all middleboxes are successully deployed, the traic rate at d will be t s m M k m, which will be used as the initial traic rate when searching path rom the path tail. When the second stage reaches a node u that has been visited in the irst stage, it means that a path rom s to d has been ound where u is the junction node o the two sections o the path. In such a case, the second stage will stop searching along that particular path. Ater the second stage inishes, the algorithm collects all the junction nodes and compares the maximum link load o their corresponding paths. The one with the minimum maximum link load will be selected. The pseudo code description o the LFGL based MinMax routing algorithm is shown in Algorithm. For easy description, we deine sc(u) to be remaining space capacity o node u, bc(u, v) to be the remaining bandwidth capacity o link (u, v), t u to be the traic rate o low when it leaves node u, i.e., t u = t (u, post(u)), and t u to be the traic rate o low beore it enters node u, i.e., t u = t (pre(u), u). Brie explanation is as ollows. Line sorts all the middleboxes in the increasing order o their traic changing actors. Lines 2 to 9 conduct initialization or the irst stage, where Saw is the set o nodes whose MinMax paths rom the source have been determined, and index[u] remembers the index o the last middlebox that has been installed on node u. For each neighbor u o the low source s, i the link (s, u) has more bandwidth than t s, then there is a possible path rom s to u. mll[u] records the maximum link load o the path until u, and pre(u) remembers the previous node beore u on the path. Lines to 25 are the loop to ind the MinMax path to a node at a time. At the beginning o each loop, the node u / Saw with the minimum maximum link load mll(u) will be selected and added to Saw. Lines 3 to 5 place shrinking middleboxes in order on u until there is no more space or no more shrinking middleboxes. Lines 6 to 8 check whether the newly selected node u is the low destination d and also whether all middleboxes have been placed. I yes, the inal MinMax path can be constructed by tracing pre(u) rom d to s, and the algorithm will exit. Otherwise, lines 2 to 24 check each neighbor v o u to see i there is a new path to v via u with lower maximum link load, and update i yes. Lines 26 to 49 run the second stage in a similar manner, but starting rom the low destination and placing expanding middleboxes. In lines 4 to 42, i the second stage reaches a node u that has been visited in the irst stage, u will be added to the junction node set J. When both stages inish, lines 5 to 54 select rom J the node u with the minimum maximum link load, and the inal MinMax path can be constructed by tracing pre(u) to s and post(u) to d. Otherwise, i J is empty, there does not exist a path that can place all the middleboxes. Since the LFGL based MinMax routing algorithm integrates the LFGL rule and widest-path routing, its complexity is the product o the two, i.e., O(( E + H V log H V ) M ). IV. EXPERIMENT RESULTS We have implemented a prototype using the open-source SDN controller Floodlight [] and emulation platorm
Algorithm LFGL based MinMax Routing : sort m M [..n] by k m in increasing order 2: Stage one init: Saw = {s }; index(s ) = 3: or each neighbor u o s do 4: i bc(s, u) t s then 5: mll(u) = load(s, u) + t s ; pre(u) = s 6: else 7: mll(u) = 8: end i 9: end or : while u / Saw, bc(pre(u), u) t pre(u) and index(pre(u)) < n and k M [index(pre(u))+] do : select such u with min mll[u]; Saw = Saw {u} 2: i = index(pre(u)) + 3: while sc(u) > and i n and k M [i] do 4: place M [i] on u; sc(u) ; i + + 5: end while 6: i u = d and i > n then 7: exit with success 8: end i 9: index[u] = i ; t u = tpre(u) m placed on u k m 2: or each neighbor v o u do 2: i bc(u, v) t u and mll(v) > max(mll(u), load(u, v) + t u )) then 22: mll(v) = max(mll(u), load(u, v) + t u ); pre(v) = u 23: end i 24: end or 25: end while 26: Stage two init: Saw = {d }; index (d ) = n + ; t d = t s m M k m ; J = 27: or each neighbor u o d do 28: i bc(u, d ) t d then 29: mll [u] = load(u, d ) + t d ; post(u) = d 3: else 3: mll [u] = 32: end i 33: end or 34: while u / Saw, bc(u, post(u)) t post(u) and pre(u) = null do 35: select such u with min mll [u]; Saw = Saw {u} 36: i = index (post(u)) 37: while sc(u) > and i and k M [i] > do 38: place M [i] on u; sc(u) ; i 39: end while 4: i u Saw and i index(u) then 4: mll[u] = max(mll[u], mll[u ]); J = J {u}; continue 42: end i 43: index [u] = i + ; t u = t post(u) / m placed on u k m 44: or each neighbor v o u do 45: i bc(v, u) t u and mll (v) > max(mll (u), load(v, u) + t u )) then 46: mll (v) = max(mll (u), load(v, u) + t u ; post(v) = u 47: end i 48: end or 49: end while 5: i J then 5: select u J with min mll[u]; exit with success 52: else 53: exit with ailure 54: end i Mininet []. In this section, we present the experiment results to demonstrate the eectiveness o our design. As explained in Section I, an SDN network is decoupled into the control plane and data plane. For the control plane, we use Floodlight as the controller, which is Java-based, modular, and OpenFlow-supported. It can work with both physical and virtual switches. Floodlight has some deault modules such as the core module, linkdiscovery module, and topology module that must be loaded each run. For simplicity and eiciency, users can set up Floodlight with minimal module dependencies based on demands. For sepeciic network management requirements, new modules can be added to Floodlight to alter the way to control the network. For the data plane, we pick Mininet as a network emulator. Mininet can conveniently create a network testbed, including virtual hosts, Open vswitches [2], and links. Since each host or switch is a virtual machine, it is possible to run real applications in Mininet to generate traic. In our implementation, we use Iper to create pairs o User Datagram Protocol (UDP) data streams rom clients to servers and measure the delay and bandwidth o the network. A. Eectiveness o LFGL Rule In the irst experiment, we compare LFGL with the last-it and random-it rules. The last-it rule sorts middleboxes in the decreasing order o their traic changing actors, and places them one by one rom the tail o the low path. The randomit rule randomly places a middlebox at one o the available nodes. We pick the tree topology in this experiment, since it is a popular topology or enterprise networks, and there is only a single path between any pair o nodes. We use a Python script to create a complete binary tree with depth o three and seven switches in Mininet. Each link has the same bandwidth o 2 Mbps, and each switch can host only two middleboxes. Each lea-switch has a connected host. We use Iper to create two UDP lows between two lea nodes with the greatest distance, and adjust the traic rate o each low rom to 5 Mbps. Each low has two associated middleboxes m and m 2 with k m =.5 and k m2 =.2. The middleboxes are simulated by irewalls that drop the corresponding percentages o traic. Figure 3(a) shows the average end-to-end delay o the three benchmark solutions. We can see that LFGL consistently beats last-it and random-it. The delay o LFGL is relatively constant, the delay o random-it increases gradually, while the delay o last-it jumps dramatically when the traic rate o each low increases to 5 Mbps. Figure 3(b) shows the maximum link load o the three solutions. Similarly, LFGL is consistently superior to the other two, and last-it has the worst perormance with the maximum link load equal to the traic rate sum o both lows. B. Eectiveness o LFGL based MinMax Routing In the second experiment, we evaluate our LFGL based MinMax Routing algorithm. The benchmark solutions will irst apply the widest-path routing algorithm [3] to ind the
Average delay (ms).4.3.2. LFGL Last it Random it Tree toplogy Maximum link load (Mbps) 2 8 6 4 2 LFGL Last it Random it Tree toplogy Average delay (ms).5.5 LFGL, shortest Last it, shortest Random it, shortest Maximum link load (Mbps) 2 5 5 LFGL, shortest Last it, shortest Random it, shortest Flow traic rate (Mbps) (a) End-to-end delay. Flow traic rate (Mbps) (b) Maximum link load. Fig. 3: Comparison under tree topology. Flow traic rate (Mbps) (a) End-to-end delay. Flow traic rate (Mbps) (b) Maximum link load. Fig. 6: Comparison under multipath topology with shortestpath routing. S 2 S 3 S 4 widest-path routing achieve lower maximum link load as well. S S 5 S 6 Fig. 4: Multipath topology. low path, and then use the last-it or random-it rule to place middleboxes. We use a topology with multiple available paths, as shown in Fig. 4. The network contains seven switches, and each link has Mbps bandwidth. Similar as in the irst experiment, we use Iper to create three UDP lows rom S, S 2, and S 5 to S 4, respectively. Each low has two associated middleboxes m and m 2 with k m =.5 and k m2 =.2, and we adjust the low traic rate rom to 5 Mbps. Fig. 5(a) and (b) show the average end-to-end delay and maximum link load o the three competing solutions. We can see that LFGL based MinMax routing consistently beats the other two, while last-it has the worst perormance. Average delay (ms)..9.8.7.6 LFGL, MinMax Last it, widest Random it, widest.5 Flow traic rate (Mbps) (a) End-to-end delay. Maximum link load (Mbps) 2 8 6 4 2 S 7 LFGL, MinMax Last it, widest Random it, widest Flow traic rate (Mbps) (b) Maximum link load. Fig. 5: Comparison under multipath topology. In the next experiment, we use similar settings, but calculate the low path by the shortest-path routing algorithm, and then apply the three rules to place middleboxes. The results are plotted in Fig. 6. By comparing Fig. 5(a) and Fig. 6(a), it can be observed that all the three placement rules achieve much shorter delay with MinMax or widest-path routing. Similarly, comparison o Fig. 5(b) and Fig. 6(b) shows that MinMax and V. CONCLUSIONS With the development o virtualization technology, NFV enables lexible deployment o middleboxes as VMs running on commodity server hardware. In this paper, we have studied how to eiciently deploy such NFV middleboxes to achieve optimal network perormance, and proposed a solution leveraging the emerging SDN technology. First, we ormulate the Traic-Aware Middlebox Placement (TAMP) problem as a graph optimization problem, and show that it is NP-hard in general. Since lows in real networks oten arrive one at a time, the solution or the TAMP problem with a single low is o practical importance. In two steps, we irst develop the LFGL rule or the known low path scenario, and then propose the LFGL based MinMax routing algorithm by integrating LFGL with widest-path routing. To validate our designs, we have implemented the proposed algorithm in the open-source Floodlight SDN controller, and conducted experiments in the Mininet system. The experiment results ully demonstrate the superiority o our algorithm over competing solutions. REFERENCES [] Joao Martins, Mohamed Ahmed, Costin Raiciu, Vladimir Olteanu, Michio Honda, Roberto Biulco and Felipe Huici, ClickOS and the Art o Network Function Virtualization, NSDI, 24. [2] J.W. Anderson, R. Braud, R. Kapoor, G.Porter, and A. Vahdat, xomb: extensible open middleboxes with commodity servers, ANCS, 22. [3] V.Sekar, N.Egi, S.Ratnasamy, M.K. Reiter, and G.Shi, Design and implementation o a consolidated middlebox architecture, NSDI, 22. [4] J.Hwang, K. K. Ramakrishnan, and Timothy Wood. NetVM: high perormance and lexible networking using virtualization on commodity platorms. NSDI,24. [5] Seyed Kaveh Fayazbakhsh et al., Enorcing Network-Wide Policies in the Presence o Dynamic Middlebox Actions using FlowTags, HotSDN, 23. [6] Luizelli, M.C.et al., Piecing together the NFV provisioning puzzle: Eicient placement and chaining o virtual network unctions, IFIP/IEEE International Symposium on Integrated Network Management, 25 [7] Qazi, Zaar Ayyub, et al. SIMPLE-ying middlebox policy enorcement using SDN. SIGCOMM, 23. [8] SDN, https://www.opennetworking.org/sdn-resources/sdn-deinition. [9] T. H. Cormen, C. E. Leiserson, R. L. Rivest, and C. Stein, Introduction to Algorithms, 3rd ed. MIT Press, 29. [] Floodlight, http://www.projectloodlight.org/loodlight/. [] Mininet, http://mininet.org/. [2] Open vswitch, http://openvswitch.org/. [3] Deepankar Medhi and Karthikeyan Ramasamy, Network Routing: Algorithms, Protocols, and Architectures, Morgan Kaumann, 27.