Flow-level loss detection with Δ-sketches
Flow-level loss detection with Δ-sketches
复制标题
DOI：
10.1145/3563647.3563653
复制
发表时间：
2022-10
期刊：
影响因子：
--
通讯作者：
Shir Landau Feibish;Zaoxing Liu;Nikita Ivkin;Xiaoqi Chen;V. Braverman;J. Rexford
中科院分区：
文献类型：
--
作者：
Shir Landau Feibish;Zaoxing Liu;Nikita Ivkin;Xiaoqi Chen;V. Braverman;J. Rexford
拥塞引起的丢包是网络运行中的一个基本问题。然而，很难检测到哪里发生了下降，更不用说哪些流量受到最大的影响了。检测短时间流量突发造成的小时间尺度掉线更具挑战性，传统的监控技术很容易错过它们。为了发现交换机内部发生的丢包，分析必须是实时的、细粒度的和高效的。然而，现代交换机具有分布式数据包处理管道，可以看到到达或离开的流量，但不能看到数据包丢弃。此外，它们没有足够的内存来存储每个流的状态。我们的MIDST系统解决了这些挑战，通过一个分布式的紧凑的数据结构与入口和出口管道之间的轻量级协调。MIDST识别不同突发持续时间内经历丢失的流以及负责的突发流。我们对真实世界的跟踪和TCP连接的评估表明，MIDST使用很少的内存（例如，320KB），同时在不同的丢失率和突发持续时间下提供高精度（95%至98%）。我们评估了低速率DDoS攻击，并展示了我们的测量结果用于攻击检测和缓解的潜在用途。
Packet drops caused by congestion are a fundamental problem in network operation. Yet, it is difficult to detect where drops are happening, let alone which flows are most affected. Detecting the small-timescale drops caused by short bursts of traffic is even more challenging, and traditional monitoring techniques can easily miss them. To uncover packet drops as they occur inside a switch, the analysis must be real-time, fine-grained, and efficient. However, modern switches have distributed packet-processing pipelines that see either the arriving or departing traffic, but not the packet drops. Additionally, they do not have enough memory to store per-flow state. Our MIDST system addresses these challenges through a distributed compact data structure with lightweight coordination between ingress and egress pipelines. MIDST identifies the flows experiencing loss, as well as the bursty flows responsible, across different burst durations. Our evaluation with real-world traces and TCP connections shows that MIDST uses little memory (e.g., 320KB) while providing high accuracy (95% to 98%) under varying loss rates and burst durations. We evaluate a low-rate DDoS attack and demonstrate the potential use of our measurement results for attack detection and mitigation.