LLM agents increasingly rely on tool calling, and the Model Context Protocol (MCP) standardizes it between agents and tool providers, reducing integration cost and driving rapid growth in tool scale. Yet a standardized interface does not make tool access work at production scale: legacy services are not MCP-callable, fast protocol evolution creates compatibility cost, large tool sets exhaust the context window, and stateful sessions complicate load balancing. We solve these with a shared control point, a centralized MCP Gateway System that makes MCP operational at cloud scale. The gateway breaks the direct-connect data plane and consolidates legacy API integration, protocol bridging, access control, and session-aware routing, while scaling out elastically at low per-call overhead. It scales agent tool access to thousands of cloud operations.

While essential for stateful modern workloads like Large Language Model agents and IoT services, long-lived connections impede cloud infrastructure agility by complicating maintenance and load balancing. Existing connection migration solutions either lack support for industrial-grade encrypted traffic or fail to prevent packet loss during handover in active production environments. To address this gap, we propose Zephyr, a zero-loss and transparent TLS connection migration framework for cross-node migration between servers with different addresses. Zephyr ensures transport-layer consistency by orchestrating an eBPF-based packet buffering mechanism to safely intercept in-flight data. At the application layer, rather than deeply modifying standard TLS libraries, Zephyr creatively reuses the native session resumption mechanism via a “fake client” strategy to reconstruct complex cryptographic states without client involvement. Implemented in widely-used industrial stacks (Nginx and OpenSSL), Zephyr achieves connection migration with approximately 4.1 ms downtime and strict zero packet loss. This approach enables seamless infrastructure optimization without disrupting cloud services.

Existing congestion control schemes for RDMA resolve the dilemma of guaranteeing high throughput and ultra-low latency to some extent from a variety of perspectives. However, they are inefficient in addressing transient large queue build-up and under-utilized bandwidth caused by frequent traffic bursts. In this paper, we argue that traffic uncertainty is the fundamental challenge that limits these schemes from addressing the aforementioned dilemma. Inspired by the investigation that aggregated flows within the same rack are relatively long-lived, we propose HierCC, which aggregates flows destined to the same IP in a rack to ease traffic uncertainty and further provides hierarchically control within the first-hop ToR and between racks. Specifically, the inter-rack rates of aggregate flows are controlled by a credit-based mechanism. Then the bandwidth obtained by the aggregated flow is allocated to the corresponding intra-rack individual flows promptly and accurately. We implement HierCC in a testbed that consists of DPDK-based end-hosts and P4-based Tofino switches. The performance of HierCC is evaluated by comprehensive testbed experiments and SystemC/NS3 simulations. Results indicate that, compared with state-of-the-art, HierCC can mitigate buffer usage by up to$10\times $and reduce the average and 99th percentile FCT by up to 84% and 80%, respectively.

It is observed that the bottleneck in distributed training has shifted from computation to communication due to contention in concurrent transmissions and substantial redundant traffic. In the Parameter Server (PS) architecture, the server aggregates gradients from multiple workers and then distributes updated model parameters back to the workers in a one-to-many manner. Currently, model parameters are distributed via unicast, sending multiple identical copies of the data, which leads to significant bandwidth waste. Although multicast can save bandwidth, current approaches have two main drawbacks: on one hand, many protocols require maintaining excessive multicast state inside the network; on the other hand, the lack of coordination among multiple multicast trees can still lead to path conflicts. In this work, we propose path-aware multicast, which includes innetwork multicast tree reservation and per-hop control multicast. Specifically, before each round of model parameter distribution, the server queries the network for a multicast tree that satisfies the bandwidth requirement. The calculated multicast tree is then returned with bandwidth reserved at its tree nodes. Next, model parameters are forwarded with hop-by-hop control along the multicast tree. After the multicast is completed, the reserved network resources are released. Our evaluation shows that in an$8 \times 8$spine-leaf topology, path-aware multicast improves link load balancing by 32.6 % compared to random multicast and accelerates model parameter distribution by up to nearly$N \times$compared to unicast, where$N$is the number of workers.

Low Earth Orbit (LEO) satellite constellations are becoming a viable means for Internet access. However, their topology changes as satellites move towards or away from orbital intersection points, leading to constant link down or up. This may cause routing table entry updates and thus path changes between satellites. A path change during transmission may lead to out-of-order packet delivery and invalidate the current TCP congestion window. While some path changes are inevitable, some are avoidable. Dijkstra's algorithm is a popular choice among the routing protocols proposed for LEO satellite networks. We observe that many next-hop route updates by Dijkstra's algorithm are avoidable. Motivated by this, we propose StableR-oute, which stabilizes routing paths from different perspectives. StableRoute Local (SR_L) leverages equal-cost shortest paths and stays with the current one if it is still valid. StableRoute K-Short (SR_K) allows a path longer than the shortest path. StableRoute Global (SR_G) leverages the predictable satellite trajectories and topology variations, and thus works out a next-hop route selection sequence that minimizes the number of route updates over a time period. The evaluation shows that SR_L, SR_K and SR_G outperform Dijkstra's algorithm, substantially reducing the number of route updates in changing topologies.

In-band Network Telemetry(INT) enables fine-grained telemetry by editing the packet header with the capability of programmable data plane to carry network status. However, INT could cause significant telemetry overhead without an effective system design. Existing measurement systems attempt to reduce this overhead by employing fixed-frequency INT sampling. Nonetheless, these methods lead to frequent measurements of network ports with large flows while neglecting ports with small flows for extended periods. In this paper, we introduce a lightweight passive telemetry system based on INT, called INTSelection. The core idea is to use a flow selection algorithm at the centralized controller so as to measure all active ports. Compared with the current method, INT-Selection reduces the bandwidth overhead by 58.2% and 2.7%.

Layer-7 load balancers (L7 LBs) improve service performance, availability, and scalability in public clouds. They rely on I/O event notification mechanisms such as epoll to dispatch connections from the kernel to userspace workers. However, early epoll versions suffered from the thundering herd problem. Epoll exclusive (available since Linux 4.5) mitigates this but introduces LIFO wakeups, causing connection concentration on a few workers. Reuseport (Linux 3.9) hashes connections across workers but suffers from hash collisions and lacks awareness of worker load. Since each worker serves multi-tenant traffic, inter-worker load balancing is critical to avoid worker overload and preserve tenant performance isolation.

Cloud providers use SmartNIC-accelerated virtual switches (vSwitches) to offer rich network functions (NFs) for tenant VMs. Constrained by limited SmartNIC resources, it is a challenge to provide sufficient network performance for high-demand VMs. Meanwhile, we observed a significant number of idle vSwitches in the data center, which led us to consider leveraging them to build a remote resource pool for high-demand virtual NICs (vNICs). In this work, we propose Nezha, a distributed vSwitch load sharing system. Nezha reuses the existing idle SmartNICs to handle the excess load from the local SmartNIC without adding new devices. Nezha offloads stateless rule/flow tables to the remote, while keeping states locally. This eliminates the need for state synchronization, facilitating load sharing and failover. The deployment cost of Nezha is only a small fraction of that required to deploy new devices. Data collected from production show that our CPS capability bottleneck has shifted from the vSwitch to the VM kernel stack, with #concurrent flows and #vNICs increased by up to 50.4x and 40x, respectively.

Alibaba Cloud's centralized gateways relied heavily on high-capacity switching ASICs, but the abrupt halt of Tofino chip evolution in Jan 2023 forced us to seek alternatives that can meet the requirements of performance, supply-chain security, code reuse, and resource efficiency. After evaluating multiple options, we developed Albatross, our 3rd gen cloud gateway based on FPGA and x86 CPUs. Albatross delivers FPGA-based packet-level load balancing to the host CPUs to prevent CPU core overload, manages large reorder buffers under high-latency jitters (100μs) during complex cloud service processing, and resolves head-of-line (HOL) blocking from packet losses or software exceptions in CPUs. To avoid being overloaded by heavy hitters due to anomalies or attacks, it also implements a two-stage rate limiter for millions of tenants with only 2MB of FPGA memory. To maximize resource utilization, Albatross uses containerization to host multiple gateway instances and designs a BGP proxy to lessen the BGP peering overhead on uplink switches caused by high-density container deployments. After hundreds of man-months of development, a single Albatross node can process 80~120Mpps of cloud network traffic with an average latency of 20μs, reducing gateway and sandbox infra costs by 50%.

This paper presents ZooRoute, a tenant-transparent, fast failure recovery service that requires no modifications to physical devices. ZooRoute leverages the overlay layer and enables traffic flows to bypass failures by altering source ports (srcPorts) in packet headers during encapsulation. To enable deployment in large-scale cloud networks, ZooRoute proposes: 1) On-demand probing to efficiently monitor a vast number of hosts while minimizing telemetry costs. 2) Table compression to record the states of numerous paths with limited on-chip resources. 3) A device-sensing mechanism to prevent unnecessary reconnections in stateful forwarding. Deployed in Alibaba Cloud for 18 months, ZooRoute has significantly improved network reliability, reducing cumulative outage time by 92.71%.

With the rapid development of the Internet of Things (IoT), an increasing amount of sensor data generated by IoT applications has been transferred to data center networks for storage and data analysis. Remote Direct Memory Access (RDMA) is widely used in data center networks because of its high performance. However, due to the characteristics of RDMA’s retransmission strategy, current load balancing schemes for data center networks are unsuitable for RDMA. In this paper, we propose SeqBalance, a load balancing framework designed for RDMA. SeqBalance implements fine-grained load balancing for RDMA through a reasonable design and does not cause reordering problems. SeqBalance detects link congestion at the switch by sensing ECN signals and link utilization, and guides routing decisions accordingly. SeqBalance’s designs are all based on existing commercial RNICs and commercial programmable switches, so they are compatible with existing data center networks. We have implemented SeqBalance Shaper for fine-grained sub-flow splitting in Mellanox CX-6 RNIC and implemented routing decisions in Intel Tofino P4 programmable switch. The results of hardware testbed experiments and large-scale simulations show that compared with existing load balancing schemes, SeqBalance improves 24.7% and 15.9% on average FCT and 99th-percentile FCT.

This paper proposes ElastiCast, a novel Bluetooth Low Energy (BLE) broadcast mode that reduces the neighbor discovery latency in offline finding networks (OFNs). ElastiCast adapts the broadcast mode of the lost devices to the scan modes of the finder devices, considering their diversity. We start with an overview of OFNs, followed by a detailed analysis of the issues and challenges of existing solutions, which motivates the design of ElastiCast. Then we provide Blender, a simulator that models the neighbor discovery behavior of different broadcasters and scanners. By adopting Blender, ElastiCast can be implemented with three components: Local Optima Estimation, Common Interest Extraction, and Interval Multiplexing, in which we capture the key features of BLE neighbor discovery and globally optimize the broadcast mode interacting with diverse scan modes. Experimental evaluation results and commercial product deployment experience demonstrate that ElastiCast is effective in achieving stable and bounded neighbor discovery latency within the power budget.

In-band Network Telemetry (INT) technology enables fine-grained network monitoring by encapsulating intra-switch network status into INT probes, which is essential in data center networks for ensuring Quality of Service (QoS). Existing INT-based telemetry systems leverage centralized controllers to compute non-overlapping probe paths, thereby facilitating lightweight and network-wide measurements. However, these systems fail to adapt effectively to network topology changes caused by link or device failures, primarily due to inflexible path planning under dynamic conditions. To address this problem, we propose INT-Source, a unified policy-based network-wide telemetry system for probing and forwarding. First, we design a data plane forwarding mechanism for INT probes to ensure telemetry coverage during topology changes and reduce telemetry overhead. Second, we design a probe packet structure and introduce a switch-based probe verification and discard mechanism to prevent redundant link probing. Third, we introduce two algorithms for INT-Source: a Single-Source algorithm to facilitate deployment and a Multi-Source algorithm to enable lightweight and scalable telemetry. Our evaluation shows that INT-Source reduces bandwidth overhead to 12.5% compared to existing methods across three network topologies. Even with a 10% link failure rate, INT-Source is able to monitor 93.1% of network ports, demonstrating strong robustness.

Remote Direct Memory Access (RDMA) is becoming a popular high-speed networking technology. It uses kernel bypass and zero copy to achieve high throughput and low latency with little CPU overhead. However, standard RoCE transmission uses Equal Cost Multipath (ECMP) for load balancing, which can result in lower transmission performance due to hash conflicts. Meanwhile, it has been verified that, unlike TCP, the unique retransmission mode and flow characteristics of RoCE make previous load balancing algorithms not well applied to RoCE. In this paper, we introduce RoCELet, a load balancing algorithm for RoCE. It achieves fine-grained RoCE load balancing by actively generating flowlets, effectively utilizing the rich end-to-end paths in the data center. We implement a prototype based on DPDK and evaluate it through small-scale testbed experiments and large-scale simulations. Our results show that compared to state-of-the-art load balancing algorithms, RoCELet optimizes 48.2% and 16.4% in average FCT and$99^{th}$-ile FCT, respectively.

With the expansion of production networks, new challenges arise in scaling telemetry systems to accommodate the massive number of network devices. In-band Network Telemetry (INT) is widely adopted for its fine-grained and accurate measurements. However, system robustness and performance scalability remain key challenges for INT-based network-wide telemetry systems. Existing INT-based measurements manage the network as a whole and rely on a centralized controller for path planning and telemetry data collection. As networks scale and the probability of failures increases, frequent re-planning leads to prolonged telemetry interruptions. In this work, we propose INT-Partition, a hierarchical and fault-tolerant in-band network telemetry system with a divide-and-conquer paradigm. INT-Partition conducts telemetry in two stages: network partitioning and telemetry within each partition, enabling scalability for mega-scale networks. Our evaluations, including mega-scale simulations using BMv2 software switches and small-scale validations on Tofino hardware switches, demonstrate the effectiveness of our approach. With 1% of network equipment out of order, INT-Partition covers over 89.67% of the area and accurately locates faults. As the network scales, telemetry planning and deployment time is reduced by 75.62% to 96.02%, and hot reloading enables seamless switching of telemetry deployment.

RoCE services are sensitive to failures and bottlenecks, which become more common as the RoCE network scales. To effectively detect and locate these problems independent of service traffic, RoCE networks require a monitoring and diagnostic system based on active probing. However, existing active probing schemes typically rely on a controller to design the probing plan for each server, which is difficult to deploy and has high synchronization overhead in multi-tenant clusters. Fortunately, rail-optimized clusters have become more common in recent years to improve network performance. In these clusters, the controller is unnecessary.

Driven by technological advances and new business models, we have seen a renewed interest in LEO satellite constellations. The deployment of large-scale LEO satellite networks is becoming a reality. The network topology changes periodically, as satellites orbit the Earth. This imposes a great challenge to network monitoring. Meanwhile, as a new network monitoring method, In-band Network Telemetry (INT) can provide per-hop granular telemetry metadata, needed to tackle the mobile nature of LEO satellite constellations. Given this, we apply INT to LEO satellite networks for real-time fine-grained monitoring. We propose a path planning solution to identify the paths for network-wide telemetry and the paths for disseminating the telemetry data to the ground facilities. By taking advantage of the predictable satellite trajectories and topology variations, the path planning solution is designed to achieve network-wide coverage and minimize telemetry overhead. We take the LEO48 constellation as an example to visually show the detailed paths of the monitoring scheme. We conduct experiments on different sizes of networks to evaluate the original path planning algorithm and the improved balanced algorithm in this paper, demonstrating the timeliness and balance of the telemetry solution.

Named Data Networking (NDN) enables efficient content distribution through in-network caching. However, the additional states of network intermediary nodes make NDN forwarding more burdensome, and the unpredictability of cache hits during forwarding leads to uncertain content retrieval latency. To overcome performance bottlenecks at the router's data plane and enhance network determinism, we propose the decoupled content router with remote content store (D-Router). This novel architecture decouples the local content store (CS) from routers and introduces the remote CS device for pooling important content. When Interest packets arrive at a router whose CS is overloaded, we ensure determinism by forwarding them to the remote CS for processing if the requested content is cached there, preventing blocking before the local CS of routers and potential random cache hits along the forwarding path. The dual-path bypass forwarding is supported through the design of routers and a dual-path routing protocol. D-Router is compatible with traditional NDN. Experiments show notable enhancements in data plane performance, including a 30% reduction in round-trip time (RTT), a 25% increase in throughput, improved determinism, and reduced network jitter. Additionally, the decoupling of CS makes it easier for network administrators to deploy network upgrades.

Due to the high costs of low Earth orbit (LEO) satellite manufacturing and launch, as well as the complexity of in-orbit network protocol debugging, simulating and verifying satellite network protocols on the ground before satellite launch holds significant importance. Compared to the expensive emulation with one-to-one replication, simulation (e.g., using ns-3) can achieve discrete event processing at a relatively lower cost by extending the wall clock time. However, very few studies have used ns-3 for LEO satellite network simulation, facing challenges such as faithfully simulating the on/off state switching of inter-satellite links (ISLs) and achieving simulation performance scalability for high-density satellite constellations. In this work, we propose a system to accelerate mega-scale LEO satellite network simulation in ns-3 via MPI-based parallelization. Specifically, we simulate ISLs based on ns-3's P2P channels/P2P remote channels and achieve runtime link connection/disconnection by implementing stateful traffic dropping inside the network interface. Then, we conduct concurrent simulation with ns-3's parallel and distributed simulation capability and partition the satellite constellation into multiple simulation processes through a hierarchical clustering algorithm and automated scripts, considering satellite locality and inter-process workload balance. Our evaluation shows significant speed improvements via parallelization, e.g., a 373% speedup with 12 processes for LEO-192, and a 156% speedup with 3 processes for LEO-3072.

Considering the high costs of satellite manufacturing and launch, as well as the complexity of in-orbit debugging, pre-launch emulation on the ground will significantly reduce the development costs of low Earth orbit (LEO) satellite networks. LEO satellite network emulation faces challenges in emulating mega-scale constellations in a lightweight and scalable manner, as well as efficiently handling the frequent link on/off switching for both inter-satellite networks and terrestrial access networks. Existing simulation/emulation tools, such as NS-3, Mininet, QualNet, fall short in addressing these issues effectively. In this work, we propose a lightweight satellite emulation testbed based on Docker containers and the VLAN protocol. In the data plane, our testbed uses Docker containers to emulate satellites/terminals, and uses VETH-pairs and bridges to emulate inter-satellite networks and terrestrial access networks. Furthermore, these virtual network elements can horizontally scale across multiple servers for mega-scale constellation emulation. In the control plane, the real-time constellation topology changes are efficiently emulated through the configuration of VLAN segmentation according to satellite movement patterns. Evaluation shows the testbed's low resource occupancy and high efficiency, with 100 nodes consuming only 1000MB memory and 100 links switching in less than 2s.

For mega-scale low Earth orbit (LEO) satellite constellations, the relative position changes between satellites and ground terminals pose challenges for end-to-end TCP session maintenance, which serves as the substrate for many Internet services. Mobile IP resolves the session maintenance issue by in-troducing a binding mechanism between the care-of address and home address; however, this also leads to inefficient triangular routing. Our recently proposed LISP-LEO, through partition-satellite mapping, routes traffic to the service satellite above the destination terminal's partition, addressing the triangular routing problem. However, due to the corner case of partition-satellite mapping, LISP-LEO introduces the issue of the last-hop route selection, as well as the associated per-terminal registration states on the satellite, making the solution non-scalable. In this work, we propose Gaia, a ground station-centric mobility management scheme for LEO satellite networks. Gaia maintains a precise mapping of each ground terminal's IP and its geographical location. When receiving traffic from a source terminal, the access satellite can, based on the geographical location of the destination terminal carried by the traffic, directly locate the satellite above the destination terminal and tunnel the traffic to it. In addition, to reduce the satellite's burden, we add a DNS-like querying mechanism by offloading the mapping of terminal IPs and geographical locations to the ground station. The evaluation shows that Gaia outperforms Mobile IP and LISP-LEO in both end-to-end latency and on-board resource consumption.

The rapid development of satellite networks has precipitated an increasing demand for high bandwidth. However, compared to terrestrial networks, bandwidth resources in satellite networks are often more constrained. Hence, reasonable traffic scheduling is crucial. Because satellite networks present complex network structures, uneven traffic patterns, and strong dynamics, traditional traffic scheduling algorithms often fail in accurate analysis and modeling. Numerous intelligent routing schemes based on learning have been proposed and validated. However, due to the limitations of network modeling and generalization, it is difficult for them to quickly adapt to changing network conditions. In this paper, we propose SARO, an intelligent routing algorithm that integrates Deep Reinforcement Learning (DRL), Graph Neural Networks (GNN), and In-band Network Telemetry (INT). Compared to traditional deep learning algorithms, SARO not only overcomes the challenge of acquiring network features but also addresses the issue of limited generalization performance. Experiments show that regardless of changes in topology, SARO’s maximum link utilization is reduced by 7.6% to 15.6% compared to baseline algorithms, demonstrating SARO performs excellently in terms of load balancing and generalization.

Detecting link failures is critical to ensuring the operation of data center networks (DCNs). However, some gray link failures may go undetected by switches, leading to silent packet drops. In this paper, we propose FTA-detector, a gray link failure detection and localization approach leveraging Fault Tree Analysis (FTA), a technique previously applied in the field of reliability engineering. On the data plane, we collect fine-grained hop-by-hop information through In-band Network Telemetry (INT), detect the bidirectional connectivity of end-to-end paths through a novel aging mechanism, and implement fast reroute in response to gray link failures. On the control plane, we introduce a faulty link localization algorithm based on FTA to recommend the most likely faulty links. Specifically, we use Top K and progressive failure repair to discover and repair link faults as early as possible during failure inference, significantly reducing the overall computation complexity of sequential root cause analysis. For large-scale network topology, we propose a divide and conquer optimization scheme for scalability. To verify the efficiency of our system, we build a virtual network test platform with P4 switch software and Redis database. The test results show that FTA-detector can troubleshoot multi-point failures in DCNs in a very short time with high accuracy.

RoCE services are sensitive to network failures and performance bottlenecks, which become more common as the RoCE network scales. In addition, some non-network problems behave like network problems and can waste troubleshooting time. However, existing mechanisms cannot quickly detect and locate network problems or determine whether the service problem is network-related.

Network dataplane calls for better programmability. Current programmable network processing chips are based on either pipeline or multi-core Run-To-Completion (RTC) architecture with various trade-offs in flexibility, performance, and cost. The existing attempts to amalgamate the strengths of the two are stilted and inflexible. In this paper, we challenge the status quo by introducing a more fluid and organic programmable chip architecture, OptimusPrime, built from identical hardware blocks. Unlike the conventional static hybrid architecture, OptimusPrime allows each block to be transformed into either a pipeline stage processor or a multi-core RTC processor through software-defined configuration, enabling versatile data plane programming tailored to a wide range of applications (e.g., stateful packet processing and in-network computing). We integrate the C and P4 languages for application programming and develop algorithms to map a user program to the optimal distribution of pipeline stages and RTC cores. We demonstrate the viability of OptimusPrime through practical use cases such as in-network aggregation, in-network caching, and network function integration. We developed an FPGA-based prototype and a software-based ASIC simulator to validate the feasibility of OptimusPrime, which can be used by switches and smartNICs to enhance their programmability to a new level with high performance and low cost.

In recent years, service mesh frameworks have gained significant popularity in building microservice-based applications. A key component of these frameworks is a proxy in each K8s pod, named sidecar, which handles inter-pod traffic. Our empirical measurement reveals that such per-pod sidecars cause numerous problems, including intrusion into the user pod, excessive resource occupation, significant overhead in managing many sidecars, and performance degradation caused by passing traffic through the sidecar.

With the rapid development of Internet of the Things (IoT) technology, IoT services have higher and higher requirements for latency. In the IoT environment, virtual network functions (VNFs) are deployed on general-purpose hardware and are sequentially connected to form service function chain (SFC) to provide network services for IoT devices. However, the high latency of the link between the cloud center and the edge nodes and the resource capacity limitation of the edge nodes pose challenges to the deployment of SFCs in IoT devices. In this paper, we study the cloud-edge collaborative SFC deployment problem. We applied the network calculus theory to the cloud-edge collaborative SFC deployment for the first time, aiming to provide the end-to-end delay guarantee for the deployed SFC. We model the SFC deployment problem as Mixed Integer Nonlinear Programming (MINLP). Then we propose a heuristic algorithm (Blaze) to solve this problem. Blaze is proven to complete the deployment of SFCs in polynomial time. Finally, the algorithm is evaluated by experimental simulation. The experimental results show that compared with the existing state-of-the-art corresponding algorithms, the proposed algorithm achieves better performance in terms of the number of VNFs deployed in the cloud, resource consumption of edge nodes, and SFC request acceptance rate.

The Multipath TCP (MPTCP) protocol has received more attention due to the increasing number of terminals with multiple network interfaces. To meet the higher network performance demand of terminal services, many researches leverage reinforcement learning (RL) for MPTCP congestion control (CC) algorithms to improve the performance of MPTCP. However, we observe two limitations of existing RL-based mechanisms that make them impractical: 1) Fail to break the restriction of the input and output dimensions of RL, making the mechanisms unadaptable to the varying number of subflows. 2) Frequent model decisions block packet transmission, leading to under-utilization of bandwidth. This paper breaks the inertial thinking By “inertial thinking” here, we are referring to the initial reaction of others when dealing with CC in MPTCP. Given the interdependence between MPTCP subflows, scholars have traditionally opted for coupled CC. However, we have challenged this conventional thinking by independently handling the CC of different subflows in a single MPTCP flow and ensuring fairness. to overcome the above limitations and proposes Maggey, a non-blocking CC mechanism that applies the single-subflow model to multipath transmission. To this end, Maggey employs loosely coupled design principles and a unique reward function to ensure the fairness of the algorithm. Additionally, Maggey introduces iterative training to ensure the accuracy of training of the single-subflow model. Furthermore, a mode transition framework is artfully designed to avoid blocking, preserving the flexibility of RL-based CCs. These two features enhance the practicability of Maggey and the paper analyze the stability of Maggey. We implement Maggey in the Linux kernel and evaluate the performance of Maggey through extensive emulation and live experiments. The evaluation results show that Maggey boosts 26% throughput over DRL-CC at high bandwidth and improves 2%-60% throughput over traditional algorithms under different network conditions. Besides, Maggey maintains fairness in different scenarios.

Middleboxes are becoming indispensable in modern networks. However, programming the network stack of middleboxes to support emerging transport protocols and flexible stack hierarchy is still a daunting task. To this end, we propose Rubik, a language that greatly facilitates the task of middlebox stack programming. Different from existing hand-written approaches, Rubik offers various high-level constructs for relieving the operators from dealing with massive native code, so that they can focus on specifying their processing intents. We show that using Rubik one can program the middlebox stack with minor effort, e.g., 250 lines of code for a complete TCP/IP stack, which is a reduction of 2 orders of magnitude compared to the hand-written versions. To maintain a high performance, we conduct extensive optimizations at the middle-and back-end of the compiler. Experiments show that the stacks generated by Rubik outperform the mature hand-written stacks by at least 30% in throughput.

In-band network telemetry (INT) allows for fine-grained network monitoring, without requiring communication with the controller at each hop. Existing INT-based network-wide telemetry systems achieve low-overhead monitoring with non-overlapping path planning algorithms. However, these systems do not constrain the length of the generated probing paths, which will lead to packet loss when the size of the packet with collected telemetry data exceeds the MTU limit. To address this issue, we propose MTU-adaptive path segmentation algorithms step by step in this paper. Initially, we present two single-path planning algorithms: the INT-optimize algorithm, which produces a single path that covers the entire network with the lowest southbound communication overhead, and the INT-low-cost algorithm, which further accelerates the INT-optimize. Next, to consider the MTU limit, we propose the single-MTU adaptive INT-Segment algorithm to divide the single long path generated in the previous step into multiple path segments. In addition, we generalize the MTU-adaptive network telemetry problem and propose a multi-MTU adaptive INT-Segment solution to achieve high-performance network telemetry in networks with multiple MTU settings. Extensive evaluations demonstrate that our proposed MTU-adaptive solutions can achieve sub-second network-wide telemetry for large-scale networks, with less than 2.9ms to calculate the probing paths for an 18-pod FatTree. Furthermore, our multi-MTU adaptive INT-Segment solution significantly reduces the number of INT Sinks and INT Sources by 13.25%-42.39% when deployed in multi-MTU networks while maintaining stable telemetry data collection time. Compared with the state-of-the-art INT-path, our solution adapts the probing path to the network MTU limit, producing a telemetry data collection efficiency improvement of 10%-94%.

In RDMA (Remote Direct Memory Access) networks, end-host networks, including intra-host networks and RNICs (RDMA NIC), were considered robust and have received little attention. However, as the RNIC line rate rapidly increases to multi-hundred gigabits, the intra-host network becomes a potential performance bottleneck for network applications. Intra-host network bottlenecks can result in degraded intra-host bandwidth and increased intra-host latency. In addition, RNIC network problems can result in connection failures and packet drops. Host network problems can severely degrade network performance. However, when host network problems occur, they can hardly be noticed due to the lack of a monitoring system. Furthermore, existing diagnostic mechanisms cannot efficiently diagnose host network problems. In this paper, we analyze the symptom of host network problems based on our long-term troubleshooting experience and propose Hostping, the first monitoring and diagnostic system dedicated to host networks. The core idea of Hostping is to conduct 1) loopback tests between RNICs and endpoints within the host to measure intra-host latency and bandwidth, and 2) mutual probing between RNICs on a host to measure RNIC connectivity. We have deployed Hostping on thousands of servers in our distributed machine learning system. Not only can Hostping detect and diagnose host network problems we already knew in minutes, but it also reveals eight problems we did not notice before.

The rapid upgrade of link speed and the prosperity of new applications in data center networks (DCNs) lead to a rigorous demand for ultra-low latency and high throughput. To mitigate the overhead of traditional software-based packet processing at end-hosts, RDMA (Remote Direct Memory Access) has been widely adopted in DCNs. Particularly, congestion control (CC) mechanisms designed for RDMA have attracted much attention to avoid performance deterioration when packets lose. However, through comprehensive analysis, we found that existing RDMA CC schemes have limitations of a sluggish response to congestion and unawareness of tiny microbursts due to the long end-to-end control loop. In this paper, we propose PACC, a proactive and accurate switch-driven RDMA CC algorithm with easy deployability. PACC is driven by PI controller-based computation, threshold-based flow discrimination and weight-based allocation at the switch. It leverages real-time queue length to generate accurate congestion feedback proactively and piggybacks it to the corresponding source without modification to end-hosts. We theoretically analyze the stability, convergence and key parameter settings of PACC. Then, we implement PACC in a testbed consisting of DPDK-based end-hosts and Tofino P4 switches. In our evaluation, PACC achieves better fairness, fast reaction, high throughput, and 6$\sim$69% lower FCT (Flow Completion Time) than DCQCN, TIMELY, HPCC and RoCC.

At present, public clouds have served millions of tenants. To provide reliable services, cloud vendors need to perceive health status of the cloud network by building a telemetry system to detect possible network failures. While telemetry systems for physical networks have been extensively studied, research on telemetry systems for virtual networks is still insufficient. Different from physical networks, we conclude that building a virtual network telemetry system faces new challenges of feasibility, efficiency, and effectiveness. Specifically, we need to 1) protect privacy of tenants and adapt to heterogeneous middleboxes at the data plane; 2) handle frequent virtual network topology updates and compress large-scale measurement paths for millions of tenants at the control plane; 3) analyze telemetry results to locate network failures at the analysis plane. To address these challenges, we present Zoonet, a proactive virtual network telemetry system for multi-tenant clouds. At the data plane, Zoonet uses host agent and arp-ping to protect tenants’ privacy and defines an elegant generalization of ping and traceroute, which can work on heterogeneous middleboxes. At the control plane, Zoonet conducts update batch processing and substantial probing path pruning to lessen the overhead. At the analysis plane, Zoonet reduces noises and aggregates alerts based on temporal and spatial correlation and conducts the hop-by-hop telemetry mode to locate failures. Zoonet has been deployed in Alibaba Cloud for over two years, covering tens of cloud regions, hundreds of thousands of servers. We become increasingly reliant on Zoonet as it reduces 86% of the personnel engaged in troubleshooting.

The cloud vendors provide sharing resources for millions of tenants across the world to achieve economies of scale. At the same time, the cloud network keeps the performance isolation between different tenants as if they use their private dedicated resources. However, heavy hitters caused by a single tenant at cloud gateways will break such isolation, undermining the predictable performance expected by other cloud tenants. To prevent it, heavy hitter detection becomes a key concern at the performance-critical cloud gateways but faces the dilemma between fine granularity and low overhead. In this work, we presentCloudSentry, a scalable two-stage heavy hitter detection system dedicated to multi-tenant cloud gateways against such a dilemma. CloudSentry uses CPU utilization as an indicator of heavy hitters and conducts a lightweight coarse-grained detection running 24/7 to detect such CPU spikes. Then it invokes a fine-grained detection to precisely dump and analyze the potential heavy-hitter packets at the CPU spikes. After that, a more comprehensive analysis is conducted to associate heavy hitters with the cloud service scenarios and invoke a corresponding backpressure procedure. CloudSentry significantly reduces memory, computation and storage overhead compared with existing approaches. In a gateway cluster under an average traffic throughput of 251 Gbps, CloudSentry consumes only a fraction of 2%–5% CPU utilization with 8 KB run-time memory, producing only 10 MB heavy hitter logs during one month. Additionally, as it has been deployed in Alibaba Cloud for over two years, we share case studies and a lot of deployment experiences in this article.

In-band Network Telemetry (INT) enables hop-by-hop device-internal state exposure for maintaining and troubleshooting data center networks. To achievenetwork-widetelemetry coverage, orchestration on top of the INT primitive is required. A straightforward solution would flood the network with INT probe packets for maximum measurement coverage, which leads to a huge bandwidth overhead. A refined solution leverages the SDN controller to collect the network topology information and carry out centralized probing path planning, which, however, is inefficient in reacting to topology changes. To tackle the above problems, we proposeINT-label, a lightweight In-band Network-Wide Telemetry architecture via the distributed labeling approach. INT-label periodically labels the sampled packets with device-internal states. It is cost-effective with a minor bandwidth overhead and able to seamlessly adapt to topology changes. In order to reduce the number of labeled packets, we introduce a times-based probabilistic labeling algorithm, which allows fewer packets to carry more INT information than the interval-based algorithm. In addition, to counteract the degradation of telemetry resolution due to loss of labeled packets, we design a feedback mechanism which can adaptively change the instant labeling frequency. We provide theoretical proof that INT-label can achieve network-wide telemetry. We analyze the impact of transmission delay on coverage rate and labeling times distribution under the INT-label architecture. Evaluation on software P4 switches suggests that INT-label can achieve 99.72% measurement coverage under the labeling frequency of 20 times per second. With the adaptive labeling enabled, even if 60% of the packets are lost, the coverage can still reach 92%.

TCP was designed to provide stream-oriented communication service for bulk data transfer applications (e.g., FTP and Email). With four-decade development, Internet applications have undergone significant changes, which now involve highly dynamic traffic pattern and message-oriented communication paradigm. However, the impact of this substantial evolution on congestion control (CC) has not been fully studied. Most of the network transports today still make the long-held assumption about application traffic, i.e., a byte stream with an unlimited data arrival rate.

With the growth of dataset size and the development of hardware accelerators, the application of deep neural networks (DNN) in various fields has made great breakthroughs. In order to improve the training speed of DNN, distributed training has been widely used. However, the imbalance between computation and communication makes distributed training difficult to achieve maximum efficiency. Therefore there is a need to detect the bottleneck state and verify the effect of some optimization schemes. Testing on a physical cluster incurs additional time and cost overhead. This paper builds a DNN-specific performance model that is used for bottleneck detection and tuning at a low cost. We build this model through detailed analysis and reasonable assumptions. We also focus on fine-grained modeling of scalability and network components, which are key factors affecting performance. Then we verify the performance model with an average error of 5% on testbed and emulator. Finally, we provide use cases of the performance model.

In-band Network Telemetry (INT) empowers high-resolution network monitoring by collecting hop-by-hop device-internal states through the data plane without frequently disturbing the control plane. To achieve network-wide monitoring, a high-level orchestration is made to provision multiple monitoring paths to cover the entire network. The path number and path overlapping are kept minimum to maximally reduce the telemetry overhead. However, in production deployment, except for the telemetry overhead, the telemetry timeliness is equally important for fine-grained monitoring, which creates new requirements of balanced monitoring path planning. Given the INT probes from multiple paths are collected to the central controller for analysis, the late arrival of even one probe will delay the analysis process and affect the monitoring timeliness. To address the problem, we propose INT-balance, a novel path planning algorithm for balanced INT path generation. In INT-balance, we first break the original network graph into multiple path segments at the odd vertices. Then, we iteratively splice the two shortest path segments with the joint endpoints to form a longer path segment until the path segment number reaches half the number of the odd vertices. INT-balance generates the minimum number of INT paths with well-balanced path lengths, covering every edge of the network graph without any path overlapping. Evaluation on a network of 100 switches shows that the path length variance of INT-balance is 67% less than that of INT-path, while the algorithm execution time is increased only by 0.012s.

Off-the-shelf x86 servers are widely deployed as middleboxes in edge and public clouds, such as cloud gateways and load balancers. They follow the “run-to-completion” model and achieve parallel traffic processing by distributing packet flows across multiple CPU cores using the RSS (receive side scaling) capability of NICs. However, RSS can cause inter-core load imbalance as it conducts stateless hashing without considering the CPU core utilization. As a result, multiple heavy-hitter flows can potentially overload a single CPU core when they are hashed onto that core. In this research, we propose P4RSS, a load-aware intra-server load balancing solution that leverages the P4 data plane. Specifically, a P4 ASIC is placed in front of the CPU to perform stateful traffic load balancing among multiple CPU cores based on real-time monitoring of core utilization. In addition, flow affinity maintenance and heavy hitter throttling are also offloaded to the P4 ASIC to free up valuable CPU computing resources. P4RSS can be implemented in the form of either hyper-converged server switches or P4-based SmartNICs. Evaluation results demonstrate that P4RSS reduces the standard deviation of CPU core utilization by 22%~53% compared to RSS. This not only improves the stability of middleboxes but also allows for higher CPU utilization without overprovisioning.

Flow table capacity in programmable switches is constrained due to the limited on-chip hardware resource. The current mainstream approach is to cache only the popular rules in hardware. By taking advantage of traffic locality, the majority of packets can be forwarded directly after matching the rules cached in hardware and the remaining missed packets are handled by software that accommodates the full flow table. Existing works focus on selecting the cache entries for a single-stage flow table to achieve a high cache hit-rate, which cannot adapt to multi-stage flow tables. Due to hardware constraints as well as service requirements, it is often necessary to decompose a single-stage flow table to a multi-stage flow table or directly create multiple stages of tables in hardware. For the first time, we abstract and model the multi-stage flow table caching problem and prove the NP-hardness of the Optimal Multi-stage Flow table Caching (OMFC). Further, we propose a Greedy Caching Algorithm (GCA) for OMFC, which considers both the rule popularity across multiple stages of flow tables and entry popularity within the same stage of flow table when determining the content and size of the multi-stage flow tables. The simulation results show that GCA achieves a l0~30% higher cache hit-rate than the existing algorithms.

The emerging time-critical applications pose intense demands for enabling large-scale deterministic networks. In this paper, we propose a new Programmable Cycle-Specified Queue (PCSQ) for wide-area deterministic packet scheduling. We implement the first end-to-end high-precision rotation dequeuing, which enables microsecond-level time slot resource reservation (noted as T) and especially jitter control of up to 2T. We prototype the PCSQ scheduler on an FPGA. The PCSQ-enabled switches can guarantee bounded delay and jitter transmission on a realistic testbed.

The development of datacenter applications leads to the need for end-to-end communication with microsecond latency. As a result, RDMA is becoming prevalent in datacenter networks to mitigate the latency caused by the slow processing speed of the traditional software network stack. However, existing RDMA congestion control mechanisms are either far from optimal in simultaneously achieving high throughput and low latency or in need of additional in-network function support. In this paper, by leveraging the observation that most congestion occurs at the last hop in datacenter networks, we propose RCC, a receiver-driven rapid congestion control mechanism for RDMA networks that combines explicit assignment and iterative window adjustment. Firstly, we propose a network congestion distinguish method to classify congestions into two types, last-hop congestion and in-network congestion. Then, an Explicit Window Assignment mechanism is proposed to solve the last-hop congestion, which enables senders to converge to a proper sending rate in one-RTT. For in-network congestion, a PID-based iterative delay-based window adjustment scheme is proposed to achieve fast convergence and near-zero queuing latency. RCC does not need additional in-network support and is friendly to hardware implementation. In our evaluation, the overall average FCT (Flow Completion Time) of RCC is$4{\sim }79\%$better than Homa, ExpressPass, DCQCN, TIMELY, and HPCC.

We present Zoonet, a proactive virtual network telemetry system for multi-tenant clouds. The requirements are to (1) cover hyper-scale virtual networks with millions of tenants and millions of VMs for top tenants; (2) handle frequent virtual topology changes due to tenants' configuration through flexible APIs; (3) adapt to heterogeneous middleboxes along the probing paths; (4) achieve VM-to-VM telemetry without breaking tenant privacy; (5) differentiate virtual and physical network problems. We argue existing physical network telemetry solutions fail to satisfy our needs due to either incomplete telemetry coverage or outrageous telemetry overhead. Zoonet sets an ambitious goal to provide VM-to-VM hop-by-hop telemetry for each tenant, which is achieved based on self-developed, customizable middleboxes via hundreds of person-months under close team collaboration. At the data plane, Zoonet defines an elegant generalization of ping and traceroute, but made to work on multi-tenant clouds with heterogeneous middleboxes. At the control plane, Zoonet conducts substantial probing path pruning and update batch processing to lessen the overhead. Zoonet has been deployed in Alibaba Cloud for over two years, covering tens of cloud regions, hundreds of thousands of servers. We become increasingly reliant on Zoonet as it reduces 86% of the personnel engaged in troubleshooting.

The issue of high energy consumption and low energy utilization in data center networks (DCNs) has always been the focus of attention of both academia and industry. One general solution is to select a subset of network devices that can meet the traffic transmission requirements, thereby turning off the remaining redundant devices. However, modeling the problem as integer linear programming introduces significant time overhead, while heuristic approaches often suffer from poor generalizability. In this paper, we propose GreenDCN.ai, a closed-loop control system, which utilizes In-band Network Telemetry to collect the network-wide device-internal state, and leverages a Deep Reinforcement Learning-based energy-saving algorithm to make rapid decisions to turn on or off network device ports in response to the real-time network state. The trained GreenDCN.ai can adaptively adjust its energy-saving strategy without human intervention when the DCN topology changes. Besides, based on the regularity of the DCN topology, we design two training complexity reduction methods to address the non-convergence issue under large-scale DCN topologies. Specifically, we split the large-scale DCN topology into sub-topologies for parallel training on each sub-topology without breaking the DCN topology connectivity. Evaluation on software P4 switches suggests that GreenDCN.ai can achieve stable convergence within 590 episodes, generate effective action decisions within$\boldsymbol{79}\upmu\mathrm{s}$, and save about 34% to 39% of the network energy consumption.

In space-terrestrial integrated networks, the relative motion between LEO satellites and ground terminals is inevitable, which will trigger the reassignment of the terminal IP addresses and disrupt the ongoing TCP connections. Traditional Mobile IP protocol can solve the problem by using the home agent and the tunneling mechanism. However, for space-terrestrial integrated networks, Mobile IP is inefficient as it introduces (1) increased latency when registering with the remote home agent, (2) high packet loss due to large registration latency, (3) triangular routing to the remote home agent. To address the above issues, we propose LISP-LEO, a location/identity separation-based mobility management protocol for LEO satellite networks. Specifically, (1) we divide the Earth's surface into partitions and maintain a partition-satellite mapping table in real-time according to the regularity of satellite motion, (2) we always route traffic to the satellite above the destined terminal by querying the partition-satellite mapping table, which eliminates triangular routing and the related performance overheads, (3) we handle the corner case that multiple satellites occur above the destined terminal by proposing last-hop relay. The evaluation convinces that, for the LEO-48 constellation, LISP-LEO produces a 55.0% reduction in the RTT and a 45.8% reduction in the number of forwarding hops in the worst routing case compared with Mobile IP.

With the low latency and high coverage, the low earth orbit (LEO) satellite systems are attracting more and more venture capitals as well as research attentions. Due to their highly dynamic constellation topologies, routing protocols on the ground have to be tailored to efficiently adapt to the regular topology changes. However, for irregular topology changes caused by exceptional link failure/recovery, network-wide route flooding is still necessary for route convergence. But, this will cause significant traffic flooding redundancy due to the high density of constellation topologies. For larger-scale constellations, the redundancy issue will be exacerbated. To lessen the redundancy, this work proposes a lightweight route flooding mechanism by generating a sparse flooding topology that prunes the original full-mesh topology, and only flooding the route information on the sparse topology. By considering the maximum flooding hop as well as the robustness of the flooding topology, we design an algorithm to calculate the optimal topology instead of just applying the minimum spanning tree. The evaluation shows that, for the LEO-96 constellation, the new flooding topology has a 28.1% reduction in the inter-satellite links (ISLs) compared with the original topology, and the new flooding mechanism has a 37.52% reduction in the traffic flooded and a 10.03% reduction in the route convergence time compared with OSPF. Such improvements will be amplified on larger-scale constellations.

In multi-tenant clouds, off-the-shelf x86 boxes are widely deployed as middleboxes. With the rapid growth of cloud traffic and the migration to NFV deployment in recent years, CPU overloading at middleboxes becomes more of an issue. From our data centers, we observed that the CPU overloading was caused by heavy hitters. To address this issue, we propose MIMIC, a cloud-scale flow backpressure system, implemented onto our existing SmartNIC with FPGA acceleration. MIMIC rate-limits the selected heavy hitters through a new per-flow backpressure protocol and a new heavy-hitter detection system, to protect the other tenants. The detection system is based on hierarchical memory design, leveraging on-chip SRAM and off-chip DRAM, which can handle highly concurrent cloud traffic without the losses of flow information. We extend the design by adding a pre-filtering procedure for rapid detection. To avoid CPU being flooded by FPGA through frequent heavy-hitter reporting, due to their performance disparity, the CPU queries the FPGA on demand. The backpressure protocol is non-invasive to protect tenant privacy and allows controllable rate-limiting through the novel use of ECN and meter tables. The SmartNIC acts as a man in the middle to facilitate heavy-hitter detection and per-flow backpressuring. In a production setting, we observe that MIMIC can react quickly and bring down CPU load to the normal level within 10ms without packet losses.

In-band network telemetry (INT) enables hop-by-hop fine-grained network monitoring without interacting with the controller at every hop. Existing INT-based network-wide telemetry systems achieve low-overhead monitoring with the non-overlapped path planning algorithms. However, they do not bound the length of the generated probing paths, which may lead to packet loss when the collected telemetry data exceeds the MTU limit. In this paper, we propose an MTU-adaptive path segmentation algorithm to solve this problem. First, we provide two single-path planning algorithms: the INT-optimize algorithm produces a single path that covers the entire network with the lowest southbound communication overhead, and the INT-low-cost algorithm further improves the path planning efficiency of the INT-optimize. By taking the MTU limit into account, we further propose INT-Segment, a novel path segmentation algorithm to split the single long path produced from the previous step into multiple path segments. Extensive evaluations show that the proposed INT-Segment can realize sub-second network-wide telemetry for large-scale networks. It takes less than 2.9ms to calculate the probing paths for an 18-pod FatTree. Compared with the state-of-the-art INT-path, our solution makes the probing path well adapted to the network MTU limit and improves the telemetry efficiency by 10%-94%.

In-band network telemetry (INT) delivers high-precision network monitoring by collecting device-internal states entirely on the data plane. For rapid congestion awareness and network troubleshooting, it is necessary to conduct network-wide telemetry by generating multiple monitoring paths covering the entire network graph. Solving the optimal path planning problem used the eulerian trail initially at a time complexity of$O(k(3E+V-15k/2))$. For mega-scale data center networks, such a high complexity is unacceptable because the algorithm cannot adapt well to occasional topology changes. In this work, we propose improved INT-path and INT-react, two refined path planning algorithms with a much reduced time complexity of only$O(E)$. Furthermore, INT-react also considers balanced path generation to reduce the longest path length for synchronized collection of telemetry data from each monitoring path. The evaluation shows that on average it costs 2.10s for the improved INT-path to solve the optimal path planning for a network of 9500 switches, while the computation is completed within only 0.283s on average for INT-react. In addition, INT-react reduces the longest path length. INT-react's path planning is so fast that it promptly reacts to topology changes and is ready to be deployed in mega-scale production networks.

Time-Sensitive Networking (TSN) is proposed in recent years to satisfy the strict performance requirements of time-sensitive traffic in a growing number of emerging applications. Even though several traffic scheduling algorithms have been standardized for TSN to pursue this goal, time-sensitive flows may not be forwarded as planned and thus fail to achieve the expected performance in real networks. The fundamental cause lies in the fact that static offline planning cannot adapt to the intrinsic dynamic factors in TSN (e.g., time-synchronization error) at runtime. Hence, next-generation TSN will benefit from a closed-loop design where a performance monitoring system provides feedback of real-time packet-forwarding information. In our research, TSN-Peeper, a light-weight, fast-response and full-coverage TSN performance monitoring system, is designed and evaluated. This paper describes its architecture design and data collection mechanisms that enable timely identification and collection of packet-forwarding misbehavior at low-cost in TSN. TSN-Peeper offloads the misbehavior identification in the switch to relieve the burden on the controller and network bandwidth. To reduce the interruption frequency to the controller, it uses probe packets to collect misbehavior information in aggregation with optimized path planning. To realize controllable reporting delays, it optimizes the sending moments of probe packets according to the flow settings. Experimental results verify that TSN-Peeper offers fast response with low cost while providing full coverage and being scalable.

Network programming languages (NPLs) empower operators to program network data planes (NDPs) with unprecedented efficiency. Currently, various NPLs and NDPs coexist and no one can prevail over others in the short future. Such diversity is raising many problems including: (1) programs written with different NPLs can hardly interoperate in the same network, (2) most NPLs are bound to specific NDPs, hindering their independent evolution, and (3) compilation techniques cannot be readily reused, resulting in much wasteful work. These problems are mostly owing to the lack of modularity in the compilers, where the missing part is an intermediate representation (IR) for NPLs. To this end, we proposeNetwork Transaction Automaton (NTA), a highly-expressive and language-independent IR, and show it can express semantics of 7 mainstream NPLs. Then, we designCODER, a modular compiler based on NTA, which currently supports 2 NPLs and 3 NDPs. Experiments with real and synthetic programs show CODER can correctly compile those programs for real networks within moderate time.

RDMA has been increasingly deployed in data centers to decrease latency and CPU utilization. However, existing RDMA congestion control schemes fail to address instantaneous large queue build-up or bandwidth under-utilization associated with frequent traffic bursty. In this paper, we argue that traffic uncertainty is the essential reason that constrains data center congestion control from simultaneously achieving high throughput and deterministic latency. Since aggregated flows within the same rack are relatively long-lived, we propose HierCC, which aggregates flows destined to the same IP in a rack and hierarchically controls the rate of flows. The rate of aggregate flows between racks is controlled by a credit-based congestion control mechanism. Then the bandwidth obtained by an aggregate flow in a rack is allocated to the corresponding individual flows from that rack promptly and accurately. We evaluate HierCC using SystemC and large-scale NS3 simulations. Results indicate that HierCC can significantly mitigate buffer usage and reduce the 99th percentile FCT by up to 20% and 40% compared with HPCC and DCQCN under a realistic workload, respectively.

Software-based virtual switches are indispensable in multi-tenant cloud networks. They either work as bridges between virtual machines and the underlying networks, or act as the virtual network function carriers for flexible service chaining and orchestration. Therefore, high-accuracy monitoring of virtual switches is significant for ease of data center network management. The recently proposed In-band Network Telemetry, which relies on the protocol-independent switch architecture (PISA), can achieve the monitoring requirements. However, not all the virtual switches with production quality are P4-based or built under the PISA. In this work, we provide the design and implementation of label-based INT and probe-based INT on top of OVS and VPP, the two mainstream software-based virtual switches with non-PISA architecture. Extensive evaluation shows that our implementation has low performance overhead in terms of forwarding latency, packet loss ratio and CPU consumption. Under 100Mbps traffic pressure, the CPU overhead of INT on OVS and VPP are less than 0.1% and 0.5%, and the switch latency are added by less than$4 \mu\mathrm{s}$and$3\mu\mathrm{s}$, respectively.

The cloud network provides sharing resources for tens of thousands of tenants to achieve economics of scale. However, heavy hitters caused by a single tenant will probably interfere with the processing of the cloud gateways, undermining the predictable performance expected by other cloud tenants. To prevent it, heavy hitter detection becomes a key concern at the performance-critical cloud gateways but faces the dilemma between fine granularity and low overhead. In this work, we present CloudSentry, a scalable two-stage heavy hitter detection system dedicated to multi-tenant cloud gateways against such a dilemma. CloudSentry contains a lightweight coarse-grained detection running 24/7 to localize infrequent CPU spikes. Then it invokes a fine-grained detection to precisely dump and analyze the potential heavy-hitter packets at the CPU spikes. After that, a more comprehensive analysis is conducted to associate heavy hitters with the cloud service scenarios and invoke a corresponding backpressure procedure. CloudSentry significantly reduces memory, computation and storage overhead compared with existing approaches. Additionally, it has been deployed world-wide in Alibaba Cloud for over one year, with rich deployment experiences. In a gateway cluster under an average traffic throughput of of 251Gbps, CloudSentry consumes only a fraction of 2%-5% CPU utilization with 8KB run-time memory, producing only 10MB heavy hitter logs during one month.

SpaceX plans ambitiously to launch approximately 12,000 satellites from 2019 to 2024, expected to be a complement or even competitor to ground networks. However, the mega-scale satellite network is topology-varying and the frequency of inter-satellite link (ISL) handovers increases rapidly as the topology expands, which will further arouse a massive number of route updates with considerable packet travel delay or even packet loss during the route convergence. The classic Dijkstra's algorithm is adopted for space route calculation, however, it always selects the default shortest path from multiple equal-cost shortest paths between two satellite nodes. To reduce the route change as much as possible during the periodical topology change, in this work, we refined the original Dijkstra and propose StableRoute to select the most appropriate route from the equal-cost candidates with the least route updates compared with the routing table last round. In this way, the end-to-end paths can be maintained as far as possible without time-to-time oscillation. Evaluation shows that it reduces 41% of the route updates in a 36 × 36 topology compared with Dijkstra, and the reduction rate will rise persistently with the growth of the satellite constellation.

Visibility is essential for operating and troubleshooting intricate networks. In-band Network Telemetry (INT) has been embedded in the latest merchant silicons to offer high-precision device and traffic state visibility. INT is actually an underlying technique and each INT instance covers only one monitoring path. The network-wide measurement coverage therefore requires a high-level orchestration to provision multiple INT paths. An optimal path planning is expected to produce a minimum number of paths with a minimum number of overlapping links. Eulerian trail has been used to solve the general problem. However, in production networks, the vantage points where one can deploy probes to start and terminate INT paths are constrained. In this work, we propose an optimal path planning algorithm, INT-probe, which achieves the network-wide telemetry coverage under the constraint of stationary probes. INT-probe formulates the constrained path planning into an extended multi-depot k-Chinese postman problem (MDCPP-set) and then reduces it to a solvable minimum weight perfect matching problem. We analyze algorithm's theoretical bound and the complexity. Extensive evaluation on both wide area networks and data center networks with different scales and topologies are conducted. We show INT-probe is efficient, high-performance, and practical for real-world deployment. For a large-scale data center networks with 1125 switches, INT-probe can generate 112 monitoring paths (reduced by 50.4 %) by allowing only 1.79% increase of the total path length, promptly resolving link failures within 744.71ms.

TCAM is widely used for flow table lookup in Software-Defined Networking (SDN) switches for datacenter and enterprise networks. While its lookup throughput is unparalleled, TCAM updating, particularly for new rule insertions, can impair the overall system performance. A rule insertion entails two steps: 1) Computing the rule moving operations; and 2) Interrupting the TCAM lookups to apply the operations. In previous work, the performance gain on one step is always at the expense of the performance loss on the other. However, update throughput and latency depend on both. In this paper, we present a faster and more balanced TCAM update scheme, which not only achieves the shortest interrupt time so far but also significantly reduces the computation time. By using a novel sequential stack, FastUp reduces the time and space complexity of the state-of-the-art schemes from$O(m^{2})$and$O(m)$to$O(m\log h)$and$O(h)$, respectively, where$h << m$. Evaluations show that FastUp shortens the computation time and the interrupt time by$100\times$and$1.6\times$, respectively, which is equivalent to update delay${15\times}$reduction and$\mathbf{10\times}$update throughput gain against the state-of-the-art schemes. Moreover, we debunk a common mistake and show the dynamic programming based algorithm cannot be used to solve the reorder problem, and instead we use a bidirectional rule moving method to address the problem. In addition, we propose a practical method to find the theoretical lower bound of interrupt time in relatively large TCAM, which can be used to evaluate the optimality degree of TCAM update schemes. Evaluations show that FastUp achieves 90 % optimality.

Layer-4 load balancers play a critical role in large-scale data centers. Recently, load balancers implemented on programmable switches have attracted much attention since they overcome the inflexibility of dedicated load balancers and high latency of software load balancers. However, keeping per-connection state easily leads to storage exhaustion, especially under resource exhaustion attacks. Although several stateless load balancers are proposed to address this issue, the state management burden is offloaded to backend servers, causing high deployment and running costs. In this paper, a load balancer called Loom with compressed states is proposed for large-scale data centers. Firstly, we propose a novel classifier-based load balancer idea to avoid directly maintaining per-connection state. Then, a circulating Bloom filter structure is proposed that can efficiently classify connections as well as be implemented on existing programmable switches. Theoretical analysis shows that Loom can maintain 11 ~ 30x more concurrent connections than those directly storing the 5-tuple of connections. Loom is implemented in hardware P4 switches and experimental results indicate that 11 ~ 29x more concurrent connections can be maintained in Loom, which is close to the theoretical results. Besides, Loom is resistant to resource exhaustion attacks and reduces the percentage of broken connections by up to 57% with an SYN flood.

The development of datacenter applications leads to the need for end-to-end communication with microsecond latency. As a result, RDMA is becoming prevalent in datacenter networks to mitigate the latency caused by the slow processing speed of the traditional software network stack. However, existing RDMA congestion control mechanisms are either far from optimal in simultaneously achieving high throughput and low latency or in need of additional in-network function support. In this paper, by leveraging the observation that most congestion occurs at the last hop in datacenter networks, we propose RCC, a receiver-driven rapid congestion control mechanism for RDMA networks that combines explicit assignment and iterative window adjustment. Firstly, we propose a network congestion distinguish method to classify congestions into two types, last-hop congestion and innetwork congestion. Then, an Explicit Window Assignment mechanism is proposed to solve the last-hop congestion, which enables senders to converge to a proper sending rate in one-RTT. For in-network congestion, a PID-based iterative delay-based window adjustment scheme is proposed to achieve fast convergence and near-zero queuing latency. RCC does not need additional innetwork support and is friendly to hardware implementation. In our evaluation, the overall average FCT (Flow Completion Time) of RCC is 4~79% better than Homa, ExpressPass, DCQCN, TIMELY, and HPCC.

The In-band Network Telemetry (INT) enables hop-by-hop device-internal state exposure for reliably maintaining and troubleshooting data center networks. For achieving network-wide telemetry, orchestration on top of the INT primitive is further required. One straightforward solution is to flood the INT probe packets into the network topology for maximum measurement coverage, which, however, leads to huge bandwidth overhead. A refined solution is to leverage the SDN controller to collect the topology and carry out centralized probing path planning, which, however, cannot seamlessly adapt to occasional topology changes. To tackle the above problems, in this work, we propose INT-label, a lightweight In-band Network-Wide Telemetry architecture via interval-based distributed labelling. INT-label periodically labels device-internal states onto sampled packets, which is cost-effective with minor bandwidth overhead and able to seamlessly adapt to topology changes. Furthermore, to avoid telemetry resolution degradation due to loss of labelled packets, we also design a feedback mechanism to adaptively change the instant label frequency. Evaluation on software P4 switches suggests that INT-label can achieve 99.72% measurement coverage under a label frequency of 20 times per second. With adaptive labelling enabled, the coverage can still reach 92% even if 60% of the packets are lost in the data plane.

Power-aware traffic engineering via coordinated sleeping is usually formulated into Integer Programming problems, which are generally NP-hard with unbounded computation time for large-scale networks. This results in delayed control decision making in dynamic network environments. Motivated by advances in deep Reinforcement Learning, we consider building intelligent systems that learn to adaptively change router/switch’s power state according to changing network conditions. Neural network’s forward propagation can greatly speed up power on/off decision making. Generally, conducting RL requires a learning agent to iteratively explore and perform the "good" actions based on the feedback from the environment. By coupling Software-Defined Networking for performing centrally calculated actions to the environment and In-band Network Telemetry for collecting feedback from the environment, we develop GreenTE.ai, a closed-loop control/training system to automate power-aware traffic engineering. Furthermore, we propose novel techniques to enhance the learning ability and reduce the learning complexity. With both energy efficiency and traffic load balancing considered, GreenTE.ai can generate reasonable power saving actions within 276ms under a network testbed of 11 software P4 switches.

The cloud gateway is essential in the public cloud as the central hub of cloud traffic. We show that horizontal scaling of software gateways, once sustainable for years, is no longer future-proof facing the massive scale and rapid growth of today's cloud. The root cause is the stagnant performance of the CPU core, which is prone to be overloaded by heavy hitters as traffic growth goes far beyond Moore's law. To address this, we propose \emph{Sailfish}, a cloud-scale multi-tenant multi-service gateway accelerated by programmable switches. The new challenge is that large forwarding tables due to multi-tenancy cannot be fit into the limited on-chip memories. To this end, we devise a multi-pronged approach with (1) hardware/software co-design for table sharing, (2) horizontal table splitting among gateway clusters, (3) pipeline-aware table compression for a single node. Compared with the x86 gateway of a similar price, Sailfish reduces latency by 95% (2μs), improves throughput by more than 20x in bps (3.2Tbps) and 71x in pps (1.8Gpps) with packet length < 256B. Sailfish has been deployed in Alibaba Cloud for more than two years. It is the first P4-based cloud gateway in the industry, of which a single cluster carries dozens of Tbps traffic, withstanding peak-hour traffic in large online shopping festivals.

Software-Defined-Networking (SDN) is progressively dominating the dynamic management for timely network trouble shooting and fine grained traffic scheduling in data center networks. One critical issue in SDN is to reduce the communication overhead between the switches and the controller. Such overhead is mainly caused by handling miss-match packets, because for each miss-match packet, a switch will send a request to the controller asking for forwarding rule. Existing approaches to address this problem generally need to deploy intermediate proxy or authority switches to hold rule copies, so as to reduce the number of requests sent to the controller. In this paper, we argue that using the intrinsic buffer in a SDN switch can also greatly reduce the communication overhead without using additional devices. If a switch buffers each miss-match packet, only a few header fields instead of the entire packet are required to be sent to the controller. Experiment results show that this can reduce 78.7 percent control traffic and 37 percent controller overhead at the cost of increasing only 5.6 percent switch overhead on average. If the proposed flow-granularity buffer mechanism is adopted, only one request message needs to be sent to the controller for a new flow with many arrival packets. Thus the control traffic and controller overhead can be further reduced by 64 percent and 35.7 percent respectively on average without increasing the switch overhead.

Information-Centric Networking (ICN) provides scalable and efficient content distribution at the Internet scale due to in-network caching and native multicast. To support these features, a content router needs high performance at its data plane, which consists of three forwarding steps: checking the Content Store (CS), then the Pending Interest Table (PIT), and finally the Forwarding Information Base (FIB). In this work, we build an analytical model of the router and identify that CS is the actual bottleneck. Then, we propose a novel mechanism called “NB-Cache” to address CS’s performance issue from a network-wide point of view. In NB-Cache, when packets arrive at a router whose CS is fully loaded, instead of being blocked and waiting for the CS, these packets are forwarded to the next-hop router, whose CS may not be fully loaded. This approach essentially utilizes Content Stores of all the routers along the forwarding path in parallel rather than checking each CS sequentially. NB-Cache follows a design pattern of on-demand load balancing and can be formulated into a non-trivial N-queue bypass model. We use the Markov chain to establish its theoretical base and find an algorithm for automated transition rate matrix generation. Experiments show significant improvement of data plane performance: 70% reduction in round-trip time (RTT) and 130% increase in throughput. NB-Cache decouples the fast packet forwarding from the slower content retrieval thus substantially reducing CS’s heavy dependency on fast but expensive memory.

Ternary Content Addressable Memory (TCAM) is widely used by modern routers and switches to support policy-based forwarding due to its incomparable lookup speed and flexible matching patterns. However, the limited TCAM capacity does not scale with the ever-increasing rule table size due to the high hardware cost and high power consumption. At present, using TCAM just as a rule cache is an appealing solution, but one must resolve several tricky issues including the rule dependency and the associated TCAM updates. In this paper, we propose a new approach which can generate dependency-free rules to cache. By removing the rule dependency, the complex TCAM update problem also disappears. We provide the complete T-cache system design including slow path processing and cache replacement, and implement a T-cache prototype on Barefoot Tofino switches. We conduct comprehensive software simulations and hardware experiments based on real-world and synthesized rule tables and packet traces to show that T-cache is efficient and robust for network traffic in various scenarios.

Network programming languages (NPLs) empower operators to program network data planes (NDPs) with unprecedented efficiency. Currently, various NPLs and NDPs coexist and no one can prevail over others in the short future. Such diversity is raising many problems including: (1) programs written with different languages can hardly interoperate in the same network, and (2) most NPLs are bound to specific NDPs, hindering their independent evolution. These problems are mostly owing to the lack of modularity in the compilers, where the missing part is an intermediate representation (IR) for NPLs. To this end, we propose Network Transaction Automaton (NTA), a highly-expressive and language-independent representation as the IR. We show that NTA can express semantics of 6 mainstream NPLs, and can be composed efficiently without any semantics loss.

Network programming languages (NPLs) empower operators to program network data planes (NDPs) with unprecedented efficiency. Currently, various NPLs and NDPs coexist and no one can prevail over others in the short future. Such diversity is raising many problems including: (1) programs written with different NPLs can hardly interoperate in the same network, (2) most NPLs are bound to specific NDPs, hindering their independent evolution, and (3) compilation techniques cannot be readily reused, resulting in much wasteful work. These problems are mostly owing to the lack of modularity in the compilers, where the missing part is an intermediate representation (IR) for NPLs. To this end, we propose Network Transaction Automaton (NTA), a highly-expressive and language-independent IR, and show it can express semantics of 7 mainstream NPLs. Then, we design CODER, a modular compiler based on NTA, which currently supports 2 NPLs and 3 NDPs. Experiments with real and synthetic network programs show CODER is efficient and scalable.

In-band Network Telemetry (INT) enables fine-grained network monitoring to ease the management of large-scale networks, which, however, relies on the real-time collection of a huge amount of telemetry data through the southbound interface. For example, the INT telemetry data upload rate of a 28-pod FatTree topology reaches 3Tbps under a probe frequency of 100 times/s, which is rather unacceptable since the controller-switch link bandwidth is limited. To mitigate the telemetry data collection overhead, in this work, we propose INT-filter, a novel measurement architecture that deploys the same prediction algorithm on both the data plane and the control plane to predict the traffic state in the near future instead of uploading all the telemetry data. Such prediction-based approach leverages the observation that there is considerable redundancy in the telemetry data sequence. In addition, we design an integration mechanism that conducts predictions using multiple methods simultaneously and uploads the predicted result from the least-error method to further decrease the upload volume. Extensive evaluation suggests that INT-filter can achieve at least 33.6% data collection decrease under a 10ms probe interval. With prediction integration, the upload reduction can further reach 58.5%.

To meet the growing demand for high bandwidth of Multimedia network, IP Network Providers spend millions of dollars overprovisioning bandwidth of their network. However, due to the lack of reasonable traffic scheduling, the over-provisioning network still has a severe issue of utilization imbalance. Traffic Engineering (TE) is proposed to solve this problem. Network measurement and routing optimization strategies are two key components of TE. Effective real-time network measurement provides the basis for the generation of route optimization strategies, which makes the network congestion-aware. Existing out-band network telemetry that transmits extra probes to measure network status has the problem of inaccurate measurement information in the network. Besides, the relationship between complex network status and routing optimization strategy is difficult to describe with an exact mathematical model. Therefore, we propose a novel TE approach, which is called DPRO. It combines In-band Network Telemetry based on programmable language P4 with Reinforcement Learning to minimize network max-link-utilization. Extensive experiments show that our approach significantly outperforms several widely-used baseline methods in terms of max-link-utilization.

While widely used for flow tables in SDN switches, TCAM faces challenges for rule updates. Both the computation time and interrupt time need to be short. We propose FastUp, a new TCAM update algorithm, which improves the previous dynamic programming-based algorithms. Evaluations show that FastUp shortens the computation time by 40~100× and the interrupt time by 1.2~2.5×. In addition, we are the first to prove the NP-hardness of the optimal TCAM update problem, and provide a practical method to evaluate an algorithm's degree of optimality. Experiments show that FastUp's optimality reaches 90%.

Ternary Content Addressable Memory (TCAM) is widely used by modern routers and switches to support policy-based forwarding. However, the limited TCAM capacity does not scale with the ever-increasing rule table size. Using TCAM just as a rule cache is a plausible solution, but one must resolve several tricky issues including the rule dependency and the associated TCAM updates. In this paper, we propose a new approach which can generate dependency-free rules to cache. By removing the rule dependency, the TCAM update problem also disappears. We provide the complete T-cache system design including slow path processing and cache replacement. Evaluations based on real-world and synthesized rule tables and traces show that T-cache is efficient and robust for network traffic in various scenarios.

Network reliability becomes increasingly important in modern data center networks (DCNs). The DCNs are expected to work sustainably under internal failures and assist network operators in troubleshooting them rapidly. However, some network failures will happen silently with packets discarded without producing any explicit notification before causing tremendous damage to the network. To troubleshoot these "gray failures", in this work, we present a rapid gray failure detection and localization mechanism based on the recently proposed In-band Network Telemetry (INT). Specifically, we leverage simplified INT probe packets to conduct network-wide telemetry to help the servers under ToR switches obtain all the feasible paths between sources and destinations. Once a network failure occurs, the affected thus unavailable paths will immediately be detected and flushed out of the path information table at each server by a timeout mechanism. Hence, servers can proactively perform source routing-based fast traffic reroute to avoid massive packet loss and retain uninterrupted quality of experience. At the meantime, all the aged path entries will be uploaded to a remote controller for centralized failure localization by identifying common path elements. To verify the feasibility of our design, we build a virtual network testbed with software P4 switches and a Redis database. Evaluation shows that our system can successfully detect network gray failures and reroute the affected traffic in no time while complete failure localization within only a few seconds.

The evaluation of the web‐browsing quality of experience (QoE) is difficult to complete through traditional methods (e.g. deducing formulas or setting thresholds) due to the diversity of websites and their contents. To evaluate web‐browsing QoE through a general way, the authors propose a web QoE evaluation architecture based on machine learning, consisting of two parts: traffic classification sub‐system and QoE prediction sub‐system. When evaluating user experience, traffic classification sub‐system first classifies the packets generated by visiting a website into a flowthrough some fields in the packet header, to model each website separately. The traffic classification accuracy of packets over six websites reaches 96.63%. Then, in the network layer, the traffic metric cumulative traffic volume is generated from the size and arrival time of packets. When a user visits a web page, their regression model predicts the above‐the‐fold time (ATF) and thus QoE. The output of the regression model is an exact ATF value that is mapped to user experience. In addition, reversing input variables further improves the model, which is evaluated on two popular websites. The QoE prediction results of the improved method for 5400 visits are obtained within 0.0975 s, reaching 0.9 .

With the explosive growth of mobile devices at the edge of mobile social networks (MSNs), the amount of the content that needs to be transmitted is exploded. Traditional content delivery mechanisms leverage only local information to make routing decisions, which results in both high latency and low delivery rate. Software-defined networking (SDN) is a novel network paradigm, the design philosophy of which could be applied to MSN for improving the content delivery performance. In this article, the centralized control thought of SDN is introduced into MSN to efficiently process social information. The classical routing algorithm of BubbleRap is improved from the perspective of network density, which is the basis of designing the sparse and dense routing mechanisms for MSNs. In addition, flexibly switching between these two routing mechanisms is implemented by a discriminating scheme, achieving efficient yet adaptive routing. The experimental results show that the delivery ratio of sparse routing is up to 83%, and the dense routing could reach up to 93%.

One major research challenge for Software-Defined Networking is to properly deploy and efficiently utilize multiple controllers to improve resource utilization and maintain high network performance. While addressing this Controller Placement Problem (CPP), many existing studies overlooked the importance and influence of the Controller Scheduling Problem (CSP) with the central focus on proper distribution of requests from all switches among all controllers. In this paper, we define a new Controller Placement and Scheduling Problem (CPSP), emphasizing on the necessity and importance of tackling both CPP and CSP simultaneously in a coherent framework. To solve CPSP, we must seek a combination of solutions to both problems. Particularly, CSP is addressed based on a given solution to CPP and a Gradient-Descent-based (GD-based) scheduling algorithm is developed to optimize the probabilistic distribution of requests among all controllers. Built on the GD-based approach for controller scheduling, a Clustering-based Genetic Algorithm with Cooperative Clusters (CGA-CC) is further proposed to address CPP. In comparison to the majority of heuristic methods developed in the past, CGA-CC has two unique strengths. Specifically, it partitions a large network to substantially reduce the search space of the Genetic Algorithm (GA), resulting in fast identification of high-quality CPP solutions. Moreover, a greedy load re-distribution mechanism is developed to handle unexpected demand variations by dynamically forwarding bursting requests to neighboring sub-networks. Extensive simulations showed that our algorithms can significantly outperform several existing algorithms, including a recently proposed approach called Multi-controller Selection and Placement Algorithm (MSPA), in terms of both response time and controller utilization.

Extracting fields from layer 7 protocols such as HTTP, known as L7 parsing, is the key to many critical network applications. However, existing L7 parsing techniques center around protocol specifications, thereby incurring large human efforts in specifying data format and high computational/memory costs that poorly scale with the explosive number of L7 protocols. To this end, this paper introduces a new framework namedcontent-based L7 parsing, where the content instead of the format becomes the first class citizen. Under this framework, users only need to label what content they are interested in, and the parser learns an extraction model from the users’ labeling behaviors. Since the parser is specification-independent, both the human effort and computational/memory costs can be dramatically reduced. To realize content-based L7 parsing, we propose REPLAY which builds on recurrent neural network (RNN) and addresses a series of technical challenges like large labeling overhead and slow parsing speed. We prototype REPLAY on GPUs, and show it can achieve a precision of 98% and a recall of 97%, with a throughput as high as 12Gbps for diverse extraction tasks.

Large-scale services are generally hosted on multiple application servers to scale out in today's data centers. Load balancers distribute users' requests across these servers. Software load balancer and switch-based load balancer are two typical classes of load balancers. However, most of the existing mechanisms either exhibit high processing latency at load balancers or likely lead to unbalanced requests distribution without considering the disparity of the application servers. In this paper, we study how the disparity of application servers significantly impacts the response time of requests. A fast switch-based Load Balancer considering Application Server states (LBAS) then is proposed to minimize the processing latency at both load balancers and application servers. The data plane of LBAS is well designed to store millions of connections in limited storage capacity without violating per-connection consistency. Besides, a partial dynamic weighting algorithm based on the Ridge Regression theory is designed and implemented to decrease the processing latency at application servers. We implement LBAS using the P4 programming language and conduct a series of extensive experiments to evaluate the performance. The results demonstrate that the proposed LBAS mechanism significantly reduces the response time of requests compared with Uniform random, Static weight, and Spotlight in various scenarios.

With global coverage as well as ultra-low latency, the Low-Earth-Orbit (LEO) satellite constellation is regarded as an ideal complement to the terrestrial network infrastructure. One technical issue in LEO satellite networks is efficient and resilient routing. Considering the periodic topology changes, straightforwardly leveraging terrestrial routing protocols, such as OSPF, will incur endless route convergence, consuming expensive inter-satellite link bandwidth. Prior work proposes several snapshot-based routing approaches, which either require to store a sequence of routing table snapshots in limited satellite memory, or have to maintain frequent interaction with the ground stations. In this work, we propose OPSPF, a novel routing protocol dedicated to LEO satellite networks. OPSPF takes advantage of the regularity of the constellation and conducts periodic route calculation for instantaneous routing table generation, which well handles the regular topology changes. Moreover, OPSPF proposes an on-demand dynamic routing mechanism, dedicated to the irregular topology changes caused by link failure/recovery. Evaluation shows, compared with OSPF, OPSPF has zero route convergence overhead during regular topology changes and 57% reduction of the communication overhead and 82% reduction of the route convergence time during irregular topology changes.

With the ever-increasing complexity of networks, fine-grained network monitoring enables better network reliability and timely feedback control. The In-band Network Telemetry (INT) allows cost-effective network monitoring by encapsulating device-internal states into probe packets. However, INT only specifies an underlying device-level primitive while how to achieve network-wide traffic monitoring remains undefined. In this work, we propose INT-path, a network-wide telemetry framework, by decoupling the system into a routing mechanism and a routing path generation policy. Specifically, we embed source routing into INT probes to allow specifying the route the probe packet takes through the network. Above the mechanism, we develop an Euler trail-based path planning policy to generate non-overlapped INT paths that cover the entire network with a minimum path number. Besides, an exhaustive analysis of algorithm's run-time complexity is also provided. INT-path can “encode” the network-wide traffic status into a series of “bitmap images”, transforming network troubleshooting into pattern recognition problems. INT-path is very suitable for deployment in data center networks thanks to their symmetric network topologies.

Information-Centric Networking (ICN) provides scalable and efficient content distribution at the Internet scale due to its in-network caching and native multicast capabilities. To support these features, a content router needs high performance at its data plane, which consists of three forwarding steps: checking the Content Store (CS), then the Pending Interest Table (PIT), and finally the Forwarding Information Base (FIB). While prior works focus on performance optimization of a single step, we build an analytical model of content router's entire data plane and identify that CS is the actual bottleneck in the pipeline. Compared with PIT and FIB, CS is more challenging because it has more data to read/write, may have more entries in its table to store and lookup, and needs to organize content objects to sustain frequent cache replacement. Then, we propose a novel mechanism called "NB-Cache" to address CS's performance issue from a network-wide point of view rather than a single router's. In NB-Cache, when packets arrive at a router whose CS is fully loaded, instead of being blocked and waiting for the CS, these packets are forwarded to the next-hop router, whose CS may not be fully loaded. This approach essentially utilizes Content Stores of all the routers along the forwarding path in parallel rather than checking each CS sequentially. Our experiments show significant improvement of data plane performance: 70% reduction in round-trip time (RTT) and 130% increase in throughput.

Software Defined Network (SDN) enables flexible update of network functions with a well-defined abstraction between the control and the data plane. However, multiple active network functions with the same priority will potentially trigger conflicts among policies with overlapped flow space, causing the flow table explosion. In contrast to the local switch conflict resolution schemes proposed by previous works, this paper tackles the same problem from a different angle and resolves the policy conflict problem by coordinating all switches under a global centralized view. Specifically, we propose COnflict RAzor (CORA), which tremendously reduces the storage cost of conflicting policies leveraging the global network information obtained in the controller. The basic idea of CORA is migrating policies causing large explosions across the network if necessary, while keeping the semantics equivalence. We prove CORA's NP hardness and propose a heuristic to efficiently search a near-optimal policy migration strategy. Our experiments demonstrate that, CORA can effectively reduce the flow table storage occupation by at least 49% within less than 40 seconds.

The prohibitive cost of deploying a sophisticated DNS-based CDN makes anycast-based CDN an attractive alternative for new or small CDN operators. In anycast-based CDNs, user requests are naturally routed to the “closest” server determined by Internet routing. For the operators, however, this comes at a cost—loss of control—how the traffic is routed is entirely at the mercy of BGP routing. The “closest” server may be overloaded, or simply not the best choice. This “loss of control” undermines thescalabilityof anycast-based CDN architectures. To have control over how traffic is routed, existing work either requires adding a large amount of complexity to the system (high Capex/Opex) or is unable to achieve precise and fine-grained control. This paper proposes T-SAC, a scalable anycast-based CDN architecture that capitalizes on the programmability and flexibility of SDN/NFV, enabling fine-grained traffic redirection among CDN servers. T-SAC achieves precise control by leveraging a load-based redirection algorithm and a single 1-bit no-redirect flag. We implement T-SAC in the real system and evaluate its performance from various aspects using DASH and web applications. The results show that T-SAC is capable of redirecting the right amount of traffic at the right time to the right servers, making the system highly scalable.

In this work, we propose OpenSched, a layered architecture that glues the QoS apps, the controller and the switches together to maximally unleash the power of centralized QoS control. Specifically, our design consists of (1) a flexible northbound interface via the ``builder pattern'', (2) one-to-many controller-switch interactions via device abstraction, thread pooling and Java NIO's selector mechanism, and (3) efficient southbound protocol handling as well as QoS policy execution via a producer-consumer model at the switch side. We build a prototype based on ONOS and OVS with 2340 lines of Java code and 1097 lines of c code. OpenSched is expected to facilitate flexible network resource provisioning.

A lot of recent work has focused on reducing in network queueing latency in datacenter networks. In this paper, we focus on a less explored topic --- latency increases caused by queueing in rate limiters on the end-host. First, we show that latency can be increased by an order of magnitude by rate limiters in cloud networks. To solve this problem, we extend ECN marking into rate limiters and use a datacenter congestion control algorithm --- DCTCP. Unfortunately, while this reduces latency, it also leads to throughput oscillation. Thus, this solution is not sufficient. In this paper, we also analyze the specific reasons that ECN marking in software rate limiters leads to the throughput oscillation problem. Finally, we propose two potential solutions to design software rate limiters that can achieve stable high throughput and low latency.

With the in-network caching capability embedded, packet forwarding in CCN (content-centric networking) becomes rather sophisticated. To enable wire-speed forwarding, previous works have reported exciting component-level performance achievements. However, a proper system-level model for exact bottleneck identification and accordingly performance tuning is still absent. In this paper, we build two such models dedicated to the two common implementation variants of a CCN router, i.e., the pipeline model and the run- to-completion model, respectively. By carefully investigating and analyzing the interactions between FIB (forwarding information base), PIT (pending interest table) and CS (content store) in the two models, we quantitatively identify that CS is the exact performance bottleneck of the entire CCN packet forwarding engine. This conclusion is very timely (if not too late) because in the past, researchers invest a lot of time and effort in optimizing FIB and PIT while very limited for CS. According to the mathematics, we suggest that the research community should shift more attention to CS performance tuning or totally rethink the entire packet forwarding architecture.

Recently, designing information-agnostic coflow scheduling mechanisms attracts much attention since by leveraging priority queues, they could reduce coflow completion time in data-parallel clusters without a priori knowledge, such as flow size, coflow size. However, existing information-agnostic mechanisms generally schedule coflows only according to the sent data size of different coflows and ignore other useful coflow-level attributes like width, length and communication patterns. In this paper, we investigate that the coflow completion time could be further decreased by jointly leveraging multiple coflow-level attributes. Based on this investigation, we present a Multiple-attributes-based Coflow Scheduling (MCS) mechanism to reduce the coflow completion time. In MCS, a Shortest and Narrowest Coflow First (SNCF) algorithm is designed to separate coflows based on their widths and estimated lengths at the start of a coflow. During the transmission of coflows, one type of demotion thresholds employed in previous coflow scheduling mechanisms is too crude for various coflows. Therefore, we proposed a double-threshold scheme to adjust the priorities of narrow (small coflow width) and wide (large coflow width) coflows according to different thresholds. Trace-driven simulations with production workloads show that MCS outperforms the previous information-agnostic scheduler Aalo, and reduces the coflow completion time of small coflows.

One critical issue in SDN is to reduce the communication overhead between the switches and the controller. Such overhead is mainly caused by handling miss-match packets, because for each miss-match packet, a switch will send a request to the controller asking for forwarding rule. Existing approaches to address this problem generally need to deploy intermediate proxy or authority switches to hold rule copies, so as to reduce the number of requests sent to the controller. In this paper, we argue that using the intrinsic buffer in a SDN switch can also greatly reduce the communication overhead without using additional devices. If a switch buffers each miss-match packet, only a few header fields instead of the entire packet are required to be sent to the controller. Experiment results show that this can reduce 78.7% control traffic and 37% controller overhead at the cost of increasing only 5.6% switch overhead on average. If the proposed flow-granularity buffer mechanism is adopted, only one request message needs to be sent to the controller for a new flow with many arrival packets. Thus the control traffic and controller overhead can be further reduced by 64% and 35.7% respectively on average without increasing the switch overhead.

ECN thresholds have limited operational range and very strict scope. Lower thresholds exacerbate the queue underflow while higher thresholds increase the queueing delays. In this paper, an Adaptive ECN (A-ECN) marking scheme is proposed to enhance the performance of ECN. A-ECN can adaptively adjust ECN marking thresholds in different scenarios to achieve good generality. Therefore, network operators can directly deploy A-ECN in various environments regardless of underlying queue types and bandwidth.

Data transfer duration accounts for a great proportion of job completion time in big-data systems. To reduce the time spent on data transfer, some traffic scheduling mechanisms at coflow-level are proposed recently. Most of them abstract datacenter networks as an ideal non-blocking big-switch, and the bottleneck is located at egress or ingress ports of end-hosts instead of in networks. Thus, they mainly focus on how to allocate port capacities of end-hosts to jobs without considering innetwork congestion. However, link congestion frequently occurs in datacenter networks due to network oversubscription and load imbalance. When link congestion occurs, bottleneck locations will move from the ports of end-hosts to network links. In this paper, we design and implement SkipL, a congestionaware coflow scheduler which could detect congestion and schedules coflows at end-hosts to effectively reduce coflow completion time. In addition, to be easily deployed in cloud environments, SkipL does not require to control flow routes. SkipL prototype system is implemented in Linux. The results of experiments conducted in a real small testbed and simulations conducted in the flow-level simulator show that SkipL reduces the average Coflow Completion Time(CCT) compared to the per-flow fair sharing scheduling method and Varys.

Named data networking (NDN) is a future Internet architecture that directly emphasizes accessible content by assigning each piece of content a unique name. Data transmission in NDN is realized via name-based routing and forwarding. Name-based forwarding information base (FIB) usually has much more and longer prefixes than IP-based ones, and therefore, name-based forwarding brings more challenges on the NDN router in terms of high forwarding throughput, low memory consumption, and fast FIB update. In this paper, we present an index data structure called BFAST for the name-based FIB. BFAST is designed based on a basic hash table, it employs a counting Bloom filter to balance the load among hash table slots, so that the number of items in each non-empty slot is close to 1, leading to low searching time in each slot. Meanwhile, the first-rank-indexed scheme is proposed to effectively reduce the massive memory consumption required by the pointers in all the hash table slots. Evaluation results show that, for the longest prefix match FIB lookup, BFAST achieves a speed of 2.14 MS/S using one thread, and meanwhile, the memory consumption is reasonably low. By leveraging the parallelism of today's multi-core CPU, BFAST arrives at an FIB lookup speed of 33.64 MS/S using 24 threads, and the latency is around 0.71 μs.

The explosion of network bandwidth poses greatchallenges to data-plane flow processing. Due to the variable andpoor worst-case performance, naive hash table is incapable ofwire-speed processing. State-of-the-art schemes rely on multiplehash functions for enhanced load balancing to improve the worst-case performance. These schemes exploit the memory hierarchyand allocate compact on-chip data structures as the off-chiphash table summaries. However, when the flow number inflates, they fail to scale the on-chip memory consumption gracefully. This work is inspired by modern DRAM's burst-transfer feature. Specifically, we propose bandwidth-greedy hashing which resolveshash collisions with just one DRAM burst. Besides, load balancingefforts are made in an "on-demand" fashion. This radicaldesign surmounts the major obstacle of mapping multiple choicehashing schemes to real-world hierarchical memory systems formassive-scale items. Essentially, this solution follows a designpattern of on-demand load balancing and can be regarded asa generalization of closed hashing. To establish its theoreticalbase, we analyze it via Poisson distribution approximation. Theevaluation on DRAMSim2 reports that our scheme requires onlyone DRAM burst access (in 99.999% cases) and minuscule on-chip memory (less than 16MB, or 1% of the previous) to supportlookups for 100M flows at a throughput of 122.82Mpps.

Per-flow measurement can provide fine-grained statistics for advanced network management and thus has been studied extensively. As network line rate continues its rapid growth, wire-speed per-flow measurement meets great challenges, for large numbers of statistics counters are required to record flow information at extremely high speed. Most of the previous efforts are committed to elaborate excellent sampling algorithms to make counters' memory occupation as small as possible, so as to fit into off-chip SRAM(s), but the throughput is rigidly bounded by the speed of SRAM. To break the wall, we explore a new path by proposing CASE: a cache-assisted stretchable estimator, which uses the on-chip memory as the fast cache of the off-chip SRAM. In this way, most of the accesses to the counters will happen on cache, thanks to the heavy-tailed distribution of Internet traffic. In this paper, we present CASE's design and derive strict mathematical proof to its relative error bound. Extensive experiments on real-world traces are conducted and the evaluation results indicate CASE can achieve up to 300Gbps throughput when using on-chip memory with 128K entries (equivalent to 1.125MB). Meanwhile CASE is more accurate and stretchable than uncached approaches.

We present FDALB, a flow distribution aware load balancing mechanism aimed at reducing flow collisions and achieving high scalability. FDALB, like the most of centralized methods, uses a centralized controller to get the view of networks and congestion information. However, FDALB classifies flows into short flows and long flows. The paths of short flows and long flows are controlled by distributed switches and the centralized controller respectively. Thus, the controller handles only a small part of flows to achieve high scalability. To further reduce the controller's overhead, FDALB leverages end-hosts to tag long flows, thus switches can easily determine long flows by inspecting the tag. Besides, FDALB can adaptively adjust the threshold at each end-host to keep up with the flow distribution dynamics.

As the network infrastructure has been consuming more and more power, various schemes have been proposed to improve the power efficiency of network devices. Many schemes put links to sleep when idle and wake them up when needed. A presumption in these schemes, though, is that router's line cards can be waken up very quickly. However, through systematic measurement of a major vendor's high-end routers, we find that it takes minutes to get a line card ready under the current design. To address this issue, we propose a new line card design that 1) keeps the host processor in a line card standby, which only consumes a small fraction of power but will save considerable wakeup time, and 2) downloads a slim slot of popular prefixes with higher priority, so that the line card will be ready for forwarding most of the traffic much earlier. We design algorithms as well as architecture that ensure fast and correct longest prefix match during prioritized routing prefix download. Experiments on an FPGA-based prototype show that the customized hardware can be ready to forward packets in 127.27 ms, which is 0.3% of the time the original design takes. This can better support numerous power-saving schemes based on the sleep/wakeup mechanism.

As the network infrastructure has been consuming more and more power, various schemes have been proposed to improve power efficiency of network devices. Many schemes put links to sleep when idle and wake them up when needed. A presumption in these schemes, though, is that router's line cards can be waken up quickly. However, through systematic measurement of a major vender's high-end router, we find that it takes minutes to get a line card ready under the current implementation. To address this issue, we propose a new line card design that (1) keeps the host processor in a line card always up, which only consumes a small fraction of power, and (2) downloads a slim slot of popular prefixes with higher priority, so that the line card will be ready for forwarding most of the traffic much earlier. We design algorithms that ensure fast and correct longest prefix match lookup during prioritized routing prefix download. Experiments on real hardware show that the wakeup time can be reduced to 127.27ms, which is 0.3% of the original line card wakeup time, well supporting many power-saving schemes.

High speed routers in Internet are becoming increasingly more powerful, as well as more energy hungry. However, they always show power-inefficient property due to we unilaterally in pursuit of high speed before. In response to this problem, we present a power-efficient router architecture named GreenRouter in this paper. GreenRouter separates a line card into two parts physically: the network interface card (named as DB) and the packet processing card (named as MB), which are interconnected by a two-stage unidirectional switch fabric. Traffic from all the DBs shares all the MBs in GreenRouter, thus the traffic can be aggregated to a few active MBs when traffic is light and the inactive MBs can be shut down to save power. We give the detailed architectural design of GreenRouter. Real-trace driven experiments show that GreenRouter can save about 50% power compared to the conventional router when the average traffic load is 30%, while providing quality of service guarantee at the same time.

Internet traffic has been exponentially growing with the increasing demand of content dissemination. This explosive growth in traffic poses a significant challenge to the networks, especially backbones. To address the challenge, the emerging content-oriented Named Data Networking (NDN) has been proposed due to its attractive advantages, such as network load reduction, low dissemination latency and energy efficiency. To achieve these benefits from NDN paradigm, the content caching strategy plays the most important role. In this paper, we present a popularity-based coordinated caching scheme with the objective of eliminating both the inter-domain and intra-domain redundant traffic of a backbone network. In this design, the global content popularity is obtained by the weighted aggregation of local content popularity at the routers, then the cache placement can be calculated based on the access cost guided by the global content popularity. We test our caching scheme on the publicly available backbone networks: Abilene and GEANT. Simulation results show that the proposed caching scheme achieves around 30% higher cache hit rate and 20% more traffic reduction, compared with the widely used Leaving Copies Everywhere (LCE) and Random Cache (RanCache) scheme.

Network virtualization allows multiple virtual routers to coexist in the same physical router but offer independent routing services. Each virtual router needs to perform millions of lookups and thousands of updates per second to meet the requirements of high-speed Internet. The coexistence of these virtual routers intensifies scalability challenges to the routing lookup scheme: Can it scale well in storage, lookup speed and update performance as the number of virtual routers increases? In this paper, we propose Layer-based Overlay and Optimized Polymerization (LOOP) which has favorable scalability regardless of the number of virtual routers. Experiments on the general-purpose CPU show that LOOP achieves efficient storage, fast lookup, and fast incremental update. It compacts 18 FIBs with about 7M prefixes in total to only 4.6MB. One single thread can perform about 50M lookups per second on real-world traces. LOOP allows an update thread to run in parallel with lookup threads and barely interrupt them, and pure update testing indicates it can perform about 1M updates per second. One of the key advantages of LOOP is that it supports inserting and deleting virtual routers incrementally so it is ideal for fast and dynamic configuration of virtual networks.

In this paper we design, implement and evaluate NameFilter, a two-stage Bloom filter-based scheme for Named Data Networking name lookup, in which the first stage determines the length of a name prefix, and the second stage looks up the prefix in a narrowed group of Bloom filters based on the results from the first stage. Moreover, we optimize the hash value calculation of name strings, as well as the data structure to store multiple Bloom filters, which significantly reduces the memory access times compared with that of non-optimized Bloom filters. We conduct extensive experiments on a commodity server to test NameFilter's throughput, memory occupation, name update as well as scalability. Evaluation results on a name prefix table with 10M entries show that our proposed scheme achieves lookup throughput of 37 million searches per second at low memory cost of only 234.27 MB, which means 12 times speedup and 77% memory savings compared to the traditional character trie structure. The results also demonstrate that NameFilter can achieve 3M per second incremental updates and exhibit good scalability to large-scale prefix tables.

Flow-based packet processing exists widely in a variety of network applications, where a large sized flow table is built to keep the alive flow records. To accelerate the search speed of the flow table, numerous systems employ cache mechanism to track the most recently referenced flows. However, network traffic exhibits some different characteristics from the workload of the general computational tasks, and classic replacement policies like LRU, Random, fail to perform well in the network scenarios. To develop a network-oriented flow cache replacement policy, we propose ALFE (Adaptive Least Frequently Evicted) based on the observations of traffic's heavy tailed feature and the statistically positive correlation between the flow size and the flow cache evict times. Specifically, the correlation helps us identify elephant flows at a tiny extra cost of a few more bits allocated to each flow entry. For those who are identified as possible elephant flows, ALFE favors their priorities in the cache, thus preventing them from being flooded by the massive mice flows. A prototype system employing ALFE policy is elaborately designed and implemented besides extensive simulations. Experimental results indicate that with 1K cache entries, ALFE can achieve up to 15% higher cache hit rate than LRU on real traces.

Today's Internet applications exhibit increased diversity, while the Internet routers are still oblivious to this trend. To improve the end-to-end application QoS, one solution is to embed the application information explicitly in packet headers, but it will bring global changes. Another local solution is router-assisted traffic differentiation. To achieve this, the functionalities including packet identification and flow tracking inside the router are required. While most existing studies focus on the former, fewer efforts are put on the later. Given a large flow table is involved, how to track millions of concurrent flows in a cost-effective manner on a router's line card raises a great space-time challenge. To address this, we design an on-chip/off-chip flow tracking system to accommodate millions of flows and achieve the throughput at tens of Gigabits. By exploiting temporal locality and heavy-tailedness of Layer-4 traffic, we design the Adaptive Least Frequently Evicted (ALFE) replacement policy to catch elephant flows, therefore maintain a high cache hit rate. To alleviate performance penalty due to the cache misses, we organize the flow table in a fixed-allocated manner to fully utilize modern DRAM's burst feature. We have implemented a research prototype using FPGA for performance evaluation. The experiment results show that our system can reach 80% hit rate with a small-sized cache of 16K entries, while achieving 70Mpps throughput. This enables backbone line rate processing. Further, more than 40% power saving can be achieved by our system, which is fast and accurate with only 3% FPGA resource usage.

In Network Intrusion Detection System, De-terministic Finite Automaton (DFA) is widely used to compare packet content at a constant speed against a set of patterns specified in regular expressions (regex patterns). However, combining many regex patterns into a single DFA causes a serious state explosion. Partitioning the pat-tern set into several subsets, each of which produces a small DFA, is a practical way to deflate the state explosion. In this paper, we propose a regex pattern grouping scheme based on a new DFA model called Pattern-Based DFA (P-DFA) which supports efficient pattern-based op-erations, such as insertion, deletion, and etc. By using these basic operations, one can easily measure the state explo-sion when combining a set of regex patterns into a single DFA. Based on the privilege, we develop regex grouping algorithms for mitigating the state explosion in parallel and sequential matching environments, respectively. The evaluation shows that under the same constraints, our ap-proach requires only half the number of groups compared with the most well-known algorithms.