About the talk
Network administrators constantly monitor network traffic for congestion and attacks. They need to perform a large number of measurements on the traffic simultaneously, to detect different types of anomalies such as heavy hitters or super-spreaders. Existing techniques often focus on a single statistic (e.g., traffic volume) or traffic attribute (e.g., destination IP). However, performing numerous heterogeneous measurements within the constrained memory architecture of modern network devices poses significant challenges, due to the limited number of memory accesses allowed per packet. We propose BeauCoup, a system based on the coupon collector problem, that supports multiple distinct counting queries simultaneously while making only a small constant number of memory accesses per packet. We implement BeauCoup on PISA commodity programmable switches, satisfying the strict memory size and access constraints while using a moderate portion of other data-plane hardware resources. Evaluations show BeauCoup achieves the same accuracy as other sketch-based or sampling-based solutions using 4x fewer memory access.
00:11 Many network traffic queries
03:18 Time updating
03:52 Today's talk
05:32 Query compiler
Hello everyone. In Chelsea answering many victories one day at a time. Set alarm is Traders. Open me to ask many questions about stopping their Network to diagnose performance issues. Or there traffic has been attacked? Or is there a DDOS going out? Or many children clients in the network? IP address for more than a thousand different Source, Eyed Peas, worksheet and attribute in a stressful. I want to find out if you want to find out. If there a spreader with a source IP destination, IP,
Also, she may be worried about if we just one hose from ports, another hose on. Horse, however, most of, it's just time for a single key in a single attribute control remote to function. Yep, the number to Streator may have the dozens of network of a party is going to run together, not because she's wondering about the ultimate question of life, the universe and everything, the network, but merely because the day-to-day tasks to perform are so diverse. What a huge bowl of no traffic. Sending
packet of past Forum on x-rays too costly to make her accuracy for just incoming too much. So the best place to run his parents using the data plan of the switches. However, we come together in a switch, they open. If you look at advertising flyer for today's community, no restrictions will first see that the switch composite extra bit of traffic for second? Well that's great. Even better the president's programmable so we can run my schedule a text to be per second. What's the device? That's why make a piece of
memory structure think. So we can only run update of constant of a feist from Mary Paquette. This is a huge problem for every States, not to mention most of the structures require much more than 150 update for pocket. Given us limit for 5 is way too costly to run. I know despite memorizes limit switches. Well, it's because if I'm going to be so here's the most loved every two years. However memories to go slower than that. so your device will always have a limited memory velvet that's smaller than they were super
So we contact number to read my ass went today. We talked about how to use only a memory regardless of the number of queries. It sounds impossible but here we have a plan first each carry a smaller than one. We just combined it together cuz she was only a small constant on average butt in the worst-case, tell me what to ask her. So we coordinate just carries. So it was a most competent. Cryptocat Sports talk about a challenge which is the only way only have a limited number of memory assets for
pocket. And won't you run into from queries with different keys and attributes? We found a clever way to formula or just incoming furries as a cuckoo clock of problem. Will cut your school contract. This encounter has to count the number of the seamstress. I please put on a random mapping from so he's there, a coupon photo. Becca. She's the probability of each coupon to be flown in a random drawing. A random laughing from Source IP to coupons for every choice. I've never seen before. Ever
come over, have a 1% chance of being fought. So we need to find a nice for which means we should stop. When we see afford to print coupon Stop at approximately less than one package less than one memory asses for pocket. The car compiler tasting, a set of forest attribute and stressful to generate the number here to satisfy sprinkles or requiring. The very second, you should follow the final which also call Audra power limits for some hole in which we read and write memory in 32 bit at a time. So they can read and write
together. And then we'll just run and get some people program to run all this cool colors together. You think I will skip the video about how we do things. We follow a two-faced process to install chorus me to switch to the first such as reports and then give us the parameters and then we'll use the generator to get to go to the 6. Just wish you would check and cut all the coupons and alerts. When we see It's important to note that in a two-faced to sign
the new table rules once we finish updating chorus on a fly. So I like some earlier work, we do not need a program every time we chance Perry mix for cougar versus how and how many miles an hour down time highlights of Galatians. We are supposed to test your memory assets. Compared with a state-of-the-art security for just think it was less than 50% of its own preferred Casino programmable switch. Community question that came out last week. First, can we
come to Haver flows actually using a sketch by composing book who were some of the sketch? That's possible. But I require a special memories for packet the recent number for parts or people program it, regardless of the header Fields using the key Sinatra. Sing summary today for some fuku assistant to answer many levels have decreased one memory of the other time I always using only a constant number for Access for packing. We can transfer it on the fly without a need you to compile people program using a
voice-to-text is to check it out. Thank you very much and have some questions. But again, I will encourage the attendees to Boston questions over slack, all the zoom's given at 2. So I'll be waiting for some other questions. I can ask my questions right now. So first question, is that? Have some limitations in terms of how the system is implemented. So do you think that a certain type of drink when he's? That cannot be on? So good question. You cut me? So hurry
right now or at least in counting calories in carrots or Thai dressing up like to express a lot of parades for her. Some of them out of order, sequence podcast with something, you cannot come over. Those kind of power is retirement income. The other question that I have is that give it like, so, it seems like you have this ability to adapt to new Dynamic set of goodies coming in overtime. But what about the workload so Walter can also change over time. So how flexible is the system or like how robust system to handle changes in the
traffic time. So yeah I guess for different work clothes, Aquaria Towers Marcus am so we didn't really add that to it but maybe the next year too many reports generated for perfect look for it may be the key to low. Okay, but like do you not request in in the data structures are resistor sizes or some other data structures in the data plan itself over time which one particular form of human resource and other requirement to suffer suffer from that. But other than that, I think we are not attempting to any particular traffic is pretty robust. All right. So I
think one question we have is candy user-defined, which curries are more important and this is from Maria, okay. To use the same memory assets, which by the way, it's not a multiple. I have another question from Lars and discussion, is how well does your system perform when you have many mice clothes, that only make up a really small fraction of your overall packets. I guess it will be perfectly fine. As long as those mice blowing up a load of stressful, so maybe one of them are lucky enough to get one or two coupons, but that's by Design and none of them
will become reported that we're totally okay with that or system was designed in such a way that the Maestro has minimum minimal impact resistant shoe in the memory sites for now. I think we should be okay. Okay, questions. LifeStar, supposed to have any kind of supporting Aquarius, So we are supporting accounting and distinct counting calories and Equipment Define using a key. And I figure Accounting in going to require that are commenting, something can be in town
this summer is going to be spring so yeah, we don't need to work on some kind of counting parts. How's the traffic? I think our systems Independence to the traffic pattern, if there's a very large volume that we come in, we may run out of memory space for a saving. A lot of the keys were going to report. You guys are too many kids to report. Otherwise, I seen our system works really well enough to some very high traffic Bridge. I need all my question. So let me ask you another question.
So you mentioned that you can change on the fly to me is like that the whole world, it is in control and that's why. So it is religious. You know, you change it, something new and Brooklyn so that you don't have to touch the. So we separate the logic for electric semble passenger heatherfield hash function. Those part of sex, and data plan, and in the controller to a semester enrolled to the output of the random hash function and this match on the Fly. And that's how I talk to you at
the key. As we're just changing different Party. By Mission match this listing fees and I should be all ready to sign in with your program. And if we have a lot of priority what time, it's very likely, the new car we can just reused already, Define hash function. So we do not need help program.
Buy this talk
Buy this video
Our other topics
With ConferenceCast.tv, you get access to our library of the world's best conference talks.