skip to main content
10.1145/3355369.3355569acmconferencesArticle/Chapter ViewAbstractPublication PagesimcConference Proceedingsconference-collections
research-article

q-MAX: A Unified Scheme for Improving Network Measurement Throughput

Published: 21 October 2019 Publication History

Abstract

Network measurement is an essential building block for a variety of network applications such as traffic engineering, quality of service, load-balancing and intrusion detection. Maintaining a per-flow state is often impractical due to the large number of flows, and thus modern systems use complex data structures that are updated with each incoming packet. Therefore, designing measurement applications that operate at line speed is a significant challenge in this domain.
In this work, we address this challenge by providing a unified mechanism that improves the update time of a variety of network algorithms. We do so by identifying, studying, and optimizing a common algorithmic pattern that we call q-MAX. The goal is to maintain the largest q values in a stream of packets. We formally analyze the problem and introduce interval and sliding window algorithms that have a worst-case constant update time. We show that our algorithms perform up to X20 faster than library algorithms, and using these new algorithms for several popular measurement applications yields a throughput improvement of up to X12 on real network traces. Finally, we implemented the scheme within Open vSwitch, a state of the art virtual switch. We show that q-MAX based monitoring runs in line speed while current monitoring techniques are significantly slower.

References

[1]
https://www.openvswitch.org/.
[2]
Network-wide routing-oblivious heavy hitters - available: https://github.com/jalilm/tdhh.
[3]
q-max: A unified scheme for improving network measurement throughput - available: https://github.com/jalilm/q-max.
[4]
Redis - in-memory data structure store.
[5]
The CAIDA UCSD Anonymized Internet Traces 2016 - January. 21st.
[6]
The CAIDA UCSD Anonymized Internet Traces 2018 - equinix-nyc 2018-03-15, Direction A. https://www.caida.org/data/monitors/passive-equinix-nyc.xml.
[7]
Anderson, D., Beyan, P., Lang, K., Liberty, E., Rhodes, L., and Thaler, J. A high-performance algorithm for identifying frequent items in data streams. In ACM IMC (2017).
[8]
Andersson, A., Hagerup, T., Nilsson, S., and Raman, R. Sorting in linear time? J. Computer and System Sciences (1998).
[9]
Arashloo, M. T., Koral, Y., Greenberg, M., Rexford, J., and Walker, D. Snap: Stateful network-wide abstractions for packet processing. In ACM SIGCOMM (2016).
[10]
Assaf, E., Ben-Basat, R., Einziger, G., and Friedman, R. Pay for a sliding bloom filter and get counting, distinct elements, and entropy for free. In IEEE INFOCOM (2018).
[11]
B Yossef, Z., Jayram, T., Kumar, R., Sivakumar, D., and Trevisan, L. Counting distinct elements in a data stream. In RANDOM (2002).
[12]
Basat, R., Einziger, G., Friedman, R., Luizelli, M., and Waisbard, E. Constant time updates in hierarchical heavy hitters. In ACM SIGCOMM (2017).
[13]
Basat, R. B., Chen, X., Einziger, G., Friedman, R., and Kassner, Y. Randomized admission policy for efficient top-k, frequency, and volume estimation. IEEE/ACM Trans. Netw. (2019).
[14]
Basat, R. B., Einziger, G., and Friedman, R. Give Me Some Slack: Efficient Network Measurements. In MFCS (2018).
[15]
Ben-Basat, R., Chen, X., Einziger, G., and Rottenstreich, O. Efficient measurement on programmable switches using probabilistic recirculation. In IEEE ICNP (2018).
[16]
Ben-Basat, R., Einziger, G., Friedman, R., and Kassner, Y. Heavy hitters in streams and sliding windows. In IEEE INFOCOM (2016).
[17]
Ben-Basat, R., Einziger, G., Keslassy, I., Orda, A., Vargaftik, S., and Waisbard, E. Memento: making sliding windows efficient for heavy hitters. In ACM CoNEXT (2018).
[18]
Ben Basat, R., Einziger, G., Moraney, J., and Raz, D. Network-wide routing oblivious heavy hitters. In ACM/IEEE ANCS (2018).
[19]
Benson, T., Akella, A., and Maltz, D. A. Network traffic characteristics of data centers in the wild. In ACM IMC (2010).
[20]
Benson, T., Anand, A., Akella, A., and Zhang, M. Microte: Fine grained traffic engineering for data centers. In ACM CoNEXT (2011).
[21]
Blum, M., Floyd, R. W., Pratt, V., Riyest, R. L., and Tarjan, R. E. Time bounds for selection. J. of Computer and System Sciences (1973).
[22]
Charikar, M., Chen, K., and Farach-Colton, M. Finding frequent items in data streams. In ICALP (2002).
[23]
Chiesa, M., Rétyári, G., and Schapira, M. Lying your way to better traffic engineering. In ACM CoNEXT (2016).
[24]
Cohen, E., and Kaplan, H. Summarizing data using bottom-k sketches. In ACM PODC (2007).
[25]
Cohen, E., and Strauss, M. Maintaining time-decaying stream aggregates. In ACM SIGMOD (2003), pp. 223--233.
[26]
Cormode, G., Korn, F., and Tirthapura, S. Exponentially decayed aggregates on data streams. In IEEE ICDE (April 2008).
[27]
Cormode, G., and Muthukrishnan, S. Diamond in the rough: Finding hierarchical heavy hitters in multi-dimensional data. In In Proceedings of the 23rd ACM SIGMOD International Conference on Management of Data (2004).
[28]
Cormode, G., and Muthukrishnan, S. An improved data stream summary: The count-min sketch and its applications. J. Algorithms 55 (2004).
[29]
Cormode, G., and Muthukrishnan, S. What's hot and what's not: Tracking most frequent items dynamically. ACM Trans. Database Syst. (2005).
[30]
Cormode, G., and Muthukrishnan, S. What's hot and what's not: Tracking most frequent items dynamically. ACM Trans. Database Syst. (2005).
[31]
Cormode, G., and Muthukrishnan, S. What's hot and what's not: Tracking most frequent items dynamically. ACM Trans. Database Syst. 30, 1 (Mar. 2005).
[32]
Datar, M., Gionis, A., Indyk, P., and Motwani, R. Maintaining stream statistics over sliding windows. SIAM J. Comput. (2002).
[33]
Demaine, E. D., López-Ortiz, A., and Munro, J. I. Frequency estimation of internet packet streams with limited space. In Proc. of the 10th Annual European Symposium on Algorithms (2002), ESA, Springer-Verlag.
[34]
Demianiuk, V., Gorinsky, S., Nikolenko, S. I., and Kogan, K. Robust Distributed Monitoring of Traffic Flows. In IEEE ICNP (2019).
[35]
Dimitropoulos, X., Hurley, P., and Kind, A. Probabilistic lossy counting: An efficient algorithm for finding heavy hitters. SIGCOMM Comput. Commun. Rev. 38, 1 (Jan. 2008).
[36]
Dittmann, G., and Herkersdorf, A. Network processor load balancing for high-speed links. In SPECTS (2002).
[37]
Duffield, N., Lund, C., and Thorup, M. Priority sampling for estimation of arbitrary subset sums. J. ACM (2007).
[38]
Duffield, N., Xu, Y., Xia, L., Ahmed, N. K., and Yu, M. Stream aggregation through order sampling. In ACM CIKM (2017).
[39]
Duffield, N. G., and Grossglauser, M. Trajectory sampling for direct traffic observation. IEEE/ACM Transactions Networking (2001).
[40]
Estan, C., and Varghese, G. New directions in traffic measurement and accounting. SIGCOMM Comput. Commun. Rev. 32, 4 (Aug. 2002).
[41]
Fusy, E., and Giroire, F. Estimating the number of active flows in a data stream over a sliding window. In ANALCO (2007).
[42]
Garcia-Teodoro, P., DãŊaz-Verdejo, J. E., Maciãą-Fernãąndez, G., and Vãązquez, E. Anomaly-based network intrusion detection: Techniques, systems and challenges. Computers and Security (2009).
[43]
Gu, Y., McCallum, A., and Towsley, D. Detecting anomalies in network traffic using maximum entropy estimation. In ACM IMC (2005).
[44]
Gupta, A., Harrison, R., Pawar, A., Birkner, R., Canini, M., Feamster, N., Rexford, J., and Willinger, W. Sonata: Query-driven network telemetry. ACM SIGCOMM (2018).
[45]
Han, Y. Deterministic sorting in o(nlog log n) time and linear space. In ACM STOC (2002).
[46]
Han, Y., and Thorup, M. Integer sorting in o (n(log log n)) expected time and linear space. In IEEE FOCS (2002).
[47]
Harrison, R., Cai, Q., Gupta, A., and Rexford, J. Network-wide heavy hitter detection with commodity switches. In ACM SOSR (2018).
[48]
Harrison, R., Cai, Q., Gupta, A., and Rexford, J. Network-wide heavy hitter detection with commodity switches. In SOSR (2018).
[49]
Huang, Q., Jin, X., Lee, P. P. C., Li, R., Tang, L., Chen, Y.-C., and Zhang, G. Sketchvisor: Robust network measurement for software packet processing. In ACM SIGCOMM (2017).
[50]
Jung, J., Paxson, V., Berger, A. W., and Balakrishnan, H. Fast portscan detection using sequential hypothesis testing. In IEEE S&P (2004).
[51]
Kabbani, A., Alizadeh, M., Yasuda, M., Pan, R., and Prabhakar, B. Af-qcn: Approximate fairness with quantized congestion notification for multi-tenanted data centers. In HOTI (2010).
[52]
Katta, N., Ghag, A., Hira, M., Keslassy, I., Bergman, A., Kim, C., and Rexford, J. Clove: Congestion-aware load-balancing at the virtual edge. In ACM CoNEXT (2017).
[53]
Kranakis, E., Morin, P., and Tang, Y. Bounds for frequency estimation of packet streams. In In SIROCCO (2003).
[54]
Langley, A., Riddoch, A., Wilk, A., Vicente, A., Krasic, C. B., Shi, C., Zhang, D., Yang, F., Kouranov, F., Swett, I., Iyengar, J., Bailey, J., Dorfman, J. C., Roskind, J., Kulik, J., Westin, P. G., Tenneti, R., Shade, R., Hamilton, R., Vasiliev, V., and Chang, W.-T. The quic transport protocol: Design and internetscale deployment. In ACM SIGCOMM (2017).
[55]
Lee, D., Choi, J., Kim, J.-H., Noh, S. H., Min, S. L., Cho, Y., and Kim, C. S. Lrfu: a spectrum of policies that subsumes the least recently used and least frequently used policies. IEEE Trans. on Comp. (2001).
[56]
Li, Y., Miao, R., Kim, C., and Yu, M. Flowradar: A better netflow for data centers. In USENIX NSDI (2016).
[57]
Li, Y., Miao, R., Kim, C., and Yu, M. Lossradar: Fast detection of lost packets in data center networks. In ACM CoNEXT (2016).
[58]
Liu, Y., Chen, W., and Guan, Y. Near-optimal approximate membership query over time-decaying windows. In IEEE INFOCOM (2013).
[59]
Liu, Z., Ben-Basat, R., Einziger, G., Kassner, Y., Braverman, V., Friedman, R., and Sekar, V. Nitrosketch: Robust and general sketch-based monitoring in software switches. In ACM SIGCOMM (2019).
[60]
Liu, Z., Manousis, A., Vorsanger, G., Sekar, V., and Braverman, V. One sketch to rule them all: Rethinking network flow monitoring with univmon. In ACM SIGCOMM (2016).
[61]
Megiddo, N., and Modha, D. S. Arc: A self-tuning, low overhead replacement cache. In USENIX FAST (2003).
[62]
Metwally, A., Agrawal, D., and Abbadi, A. E. Efficient computation of frequent and top-k elements in data streams. In IN ICDT (2005).
[63]
Mukherjee, B., Heberlein, L., and Levitt, K. Network intrusion detection. Network, IEEE 8, 3 (May 1994).
[64]
Sivaraman, V., Narayana, S., Rottenstreich, O., Muthukrishnan, S., and Rexford, J. Heavy-hitter detection entirely in the data plane. In ACM SOSR (2017).
[65]
Uyeda, F., Foschini, L., Baker, F., Suri, S., and Varghese, G. Efficiently measuring bandwidth at all time scales. In NSDI (2011).
[66]
Wang, D. Skiplist - ustcdane on github. https://github.com/ustcdane/skiplist.
[67]
Yang, T., Jiang, J., Liu, P., Huang, Q., Gong, J., Zhou, Y., Miao, R., Li, X., and Uhlig, S. Elastic sketch: adaptive and fast network-wide measurements. In SIGCOMM (2018).
[68]
Yu, M., Jose, L., and Miao, R. Software defined traffic measurement with opens-ketch. In USENIX NSDI (2013).
[69]
Zhu, Y., Kang, N., Cao, J., Greenberg, A., Lu, G., Mahajan, R., Maltz, D., Yuan, L., Zhang, M., Zhao, B. Y., and Zheng, H. Packet-level telemetry in large datacenter networks. In ACM SIGCOMM (2015).

Cited By

View all
  • (2024)Stop-Probability-Based Network Topology Discovery MethodIEICE Transactions on Communications10.23919/transcom.2024EBP3001E107-B:9(583-594)Online publication date: Sep-2024
  • (2024)SQUID: Faster Analytics via Sampled Quantile EstimationProceedings of the ACM on Networking10.1145/36768732:CoNEXT3(1-23)Online publication date: 21-Aug-2024
  • (2024)An AI-Augmented Kalman Filter Approach to Monitoring Network Traffic MatrixIEEE Transactions on Network Science and Engineering10.1109/TNSE.2023.329766011:3(2426-2437)Online publication date: May-2024
  • Show More Cited By

Index Terms

  1. q-MAX: A Unified Scheme for Improving Network Measurement Throughput

    Recommendations

    Comments

    Information & Contributors

    Information

    Published In

    cover image ACM Conferences
    IMC '19: Proceedings of the Internet Measurement Conference
    October 2019
    497 pages
    ISBN:9781450369480
    DOI:10.1145/3355369
    Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

    Sponsors

    Publisher

    Association for Computing Machinery

    New York, NY, United States

    Publication History

    Published: 21 October 2019

    Permissions

    Request permissions for this article.

    Check for updates

    Qualifiers

    • Research-article
    • Research
    • Refereed limited

    Conference

    IMC '19
    IMC '19: ACM Internet Measurement Conference
    October 21 - 23, 2019
    Amsterdam, Netherlands

    Acceptance Rates

    IMC '19 Paper Acceptance Rate 39 of 197 submissions, 20%;
    Overall Acceptance Rate 277 of 1,083 submissions, 26%

    Contributors

    Other Metrics

    Bibliometrics & Citations

    Bibliometrics

    Article Metrics

    • Downloads (Last 12 months)28
    • Downloads (Last 6 weeks)6
    Reflects downloads up to 06 Jan 2025

    Other Metrics

    Citations

    Cited By

    View all
    • (2024)Stop-Probability-Based Network Topology Discovery MethodIEICE Transactions on Communications10.23919/transcom.2024EBP3001E107-B:9(583-594)Online publication date: Sep-2024
    • (2024)SQUID: Faster Analytics via Sampled Quantile EstimationProceedings of the ACM on Networking10.1145/36768732:CoNEXT3(1-23)Online publication date: 21-Aug-2024
    • (2024)An AI-Augmented Kalman Filter Approach to Monitoring Network Traffic MatrixIEEE Transactions on Network Science and Engineering10.1109/TNSE.2023.329766011:3(2426-2437)Online publication date: May-2024
    • (2022)High-Speed Path Probing Method for Large-Scale NetworkSensors10.3390/s2215565022:15(5650)Online publication date: 28-Jul-2022
    • (2022)Towards threshold‐agnostic heavy‐hitter classificationInternational Journal of Network Management10.1002/nem.218832:3Online publication date: 7-Apr-2022
    • (2021)Routing-Oblivious Network-Wide MeasurementsIEEE/ACM Transactions on Networking10.1109/TNET.2021.306173729:6(2386-2398)Online publication date: Dec-2021
    • (2020)Robust Distributed Monitoring of Traffic FlowsIEEE/ACM Transactions on Networking10.1109/TNET.2020.3034890(1-14)Online publication date: 2020
    • (2020)Cooperative Network-wide Flow Selection2020 IEEE 28th International Conference on Network Protocols (ICNP)10.1109/ICNP49622.2020.9259395(1-11)Online publication date: 13-Oct-2020

    View Options

    Login options

    View options

    PDF

    View or Download as a PDF file.

    PDF

    eReader

    View online with eReader.

    eReader

    Media

    Figures

    Other

    Tables

    Share

    Share

    Share this Publication link

    Share on social media