It is notoriously difficult to verify that a network is behaving as intended, especially at scale. This paper presents Hydra, a system that uses ideas from runtime verification to check that every packet is correctly processed with respect to a specification in real time. We propose a domain-specific language for writing properties, called Indus, and we develop a compiler that turns properties thus specified into executable P4 code that runs alongside the forwarding code at line rate. To evaluate our approach, we used Indus to model a range of properties, showing that it is expressive enough to capture examples studied in prior work. We also deployed Hydra checkers for validating paths in source routing and for enforcing slice isolation in Aether, an open-source cellular platform. We confirmed a subtle bug in Aether's 5G mobile core that would have been hard to detect using static techniques. We also evaluated the overheads of Hydra on hardware, finding that it does not significantly increase latency and often does not require additional pipeline stages.

Network operators are facing significant challenges meeting the demand for more bandwidth, agile infrastructures, innovative services, while keeping costs low. Network Functions Virtualization (NFV) and Cloud Computing are emerging as key trends of 5G network architectures, providing flexibility, fast instantiation times, support of Commercial Off The Shelf hardware and significant cost savings. NFV leverages Cloud Computing principles to move the data-plane network functions from expensive, closed and proprietary hardware to the so-called Virtual Network Functions (VNFs). In this paper we deal with the management of virtual computing resources (Unikernels) for the execution of VNFs. This functionality is performed by the Virtual Infrastructure Manager (VIM) in the NFV MANagement and Orchestration (MANO) reference architecture. We discuss the instantiation process of virtual resources and propose a generic reference model, starting from the analysis of three open source VIMs, namely OpenStack, Nomad and OpenVIM. We improve the aforementioned VIMs introducing the support for special-purpose Unikernels and aiming at reducing the duration of the instantiation process. We evaluate some performance aspects of the VIMs, considering both stock and tuned versions. The VIM extensions and performance evaluation tools are available under a liberal open source licence.

Segment Routing (SR) is a form of loose source routing. It provides the ability to include a list of instructions, called segments, in the packet header. The SR architecture has been first implemented with the MPLS (SR-MPLS) data plane and then, quite recently, with the IPv6 data plane (SRv6). SRv6 is a promising solution to support advanced services such as Traffic Engineering, Service Function Chaining and Virtual Private Networks. The SRv6 data plane is supported in many different software forwarding engines including the Linux kernel and the Vector Packet Processor (VPP), as well as in hardware devices. In this paper, we present SRPerf, a performance evaluation framework for software and hardware implementations of SRv6. SRPerf is able to perform different benchmarking tests such as throughput and latency. The architecture of SRPerf can be easily extended to support new benchmarking methodologies as well as different SRv6 implementations. We have used SRPerf to evaluate the performance of two SRv6 implementations: Linux kernel and VPP. SRPerf is a valuable tool in the context of modern forwarding engines where new features can be added at fast pace, as it helps experimenters to validate their work. In this work, we have leveraged SRPerf to validate the implementation of some SRv6 behaviors in the Linux kernel and we have discovered and fixed some implementation flaws, making available the fixed code.

Segment Routing is a source routing based architecture that provides an opportunity to include a list of instructions called segments in the packet headers. The segments may allow the inclusion of detours for responding to Traffic Engineering needs or Service Function Chaining implementations. Even though there is an increasing interest towards enhancing and adopting Segment Routing, the administrators are still burdened with the task of manually write and maintain the segment lists. Such type of management presents several challenges ranging from error-prone configurations to increased response time for network updates. In this paper, we present a Segment Routing management framework named Busoni, which automates and simplifies the process of segments lists management. Additionally, we also provide programming tools to compose and manage Segment Routing policies that operate efficiently, even under multi-tenancy environments. Using different use cases, we show the programming capabilities offered by our framework.

We consider the IPv6 Segment Routing (SRv6) technology for Service Function Chaining of Virtual Network Functions (VNFs). Most of the VNFs are legacy VNFs (not aware of the SRv6 technology) and expect to process traditional IP packets. An SR proxy is needed to support them. We have extended the implementation of SRv6 in the Linux kernel, realizing an open source SR-proxy, referred to as SRNK (SR-Proxy Native Kernel). The performance of the proposed solution (SRNKvl) has been evaluated, identifying a poor scalability with respect to the number of VNFs to be supported in a node. Therefore we provided a second design (SRNKv2), enhancing the Linux Policy Routing framework. The performance of SRNKv2 is independent from the number of supported VNFs in a node. We compared the performance of SRNKv2 with a reference scenario not performing the encapsulation and decapsulation operation and demonstrated that the overhead of SRNKv2 is very small, on the order of 3.5%.

Optimal interface selection is a key mobility management issue in heterogeneous wireless networks. Measuring the physical or link level performance on a given wireless access networks does not provide a reliable indication of the IP connectivity, delay, and loss on the (bidirectional) paths from the Mobile Host to the node that is handling the mobility, over different heterogeneous networks. In this paper, we propose, implement, and analyze mechanisms for connectivity check and performance (network delay and packet loss) monitoring over IP access networks. We evaluate the accuracy and timeliness of the performance estimates and provide guidelines for tuning up the parameters. From the implementation perspective, we show that using application level measurements is highly CPU intensive, while a kernel based implementation has comparably a very low CPU usage. The Linux kernel implementation results in an efficient use of batteries in Mobile Hosts and intermediate Mobility Management Nodes can scale up to monitoring thousands of flows. The proposed solutions have been implemented in the context of a specific mobility management solution, but the results are of general applicability. The Linux implementation is available as Open Source.

The SRv6 architecture (segment routing based on IPv6 data plane) is a promising solution to support services like Traffic Engineering, service function chaining and virtual private networks in IPv6 backbones and datacenters. The SRv6 architecture has interesting scalability properties as it reduces the amount of state information that needs to be configured in the nodes to support the network services. In this paper, we describe the advantages of complementing the SRv6 technology with an software defined networking (SDN) based approach in backbone networks. We discuss the architecture of a SRv6 enabled network based on Linux nodes. In addition, we present the design and implementation of the Southbound API between the SDN controller and the SRv6 device. We have defined a data-model and four different implementations of the API, respectively based on gRPC, REST, NETCONF, and remote command line interface. Since it is important to support both the development and testing aspects we have realized an Intent-based emulation system to build realistic and reproducible experiments. This collection of tools automate most of the configuration aspects relieving the experimenter from a significant effort. Finally, we have realized an evaluation of some performance aspects of our architecture and of the different variants of the Southbound APIs and we have analyzed the effects of the configuration updates in the SRv6 enabled nodes.

Many reasons make NFV an attractive paradigm for IT security: lowers costs, agile operations and better isolation as well as fast security updates, improved incident responses and better level of automation. On the other side, the network threats tend to be increasingly complex and distributed, implying huge traffic scale to be monitored and increasingly strict mitigation delay requirements. Considering the current trend of the networking and the requirements to counteract to the evolution of cyber-threats, it is expected that also network monitoring will move towards NFV based solutions. In this paper, we present D-StreaMon an NFV-capable distributed framework for network monitoring realized to face the above described challenges. It relies on the StreaMon platform, a solution for network monitoring originally designed for traditional middleboxes. An evolution path which migrates StreaMon from middleboxes to Virtual Network Functions (VNFs) has been realized.

The introduction of SDN in Service Providers' networks like GÉANT is a challenging task. Prototypes of new generation services have to exhibit “carrier grade” characteristics, meet the high level expectations and specialized needs of GÉANT customers. In this demonstration, we present the SDN based prototype of GÉANT Open service, used by GÉANT customers and approved commercial partners to interconnect using Layer 2 circuits. Currently, this service is delivered through a set of Open eXchange Points leveraging on legacy solutions. The SDN based prototype has been realized on top of ONOS and leverages on hardware switches for the data plane. During the demo, which runs inside the GÉANT Testbed Service, we show how operators can deploy services and manage the SDN based infrastructure.

The current specification of the Segment Routing (SR) architecture requires enhancements to the intradomain routing protocols (e.g. OSPF and IS-IS) so that the nodes can advertise the Segment Identifiers (SIDs). We propose a simpler solution called PMSR (Poor Man's Segment Routing), that does not require any enhancement to routing protocol. We compare the procedures of PMSR with traditional SR, showing that PMSR can reduce the operation and management complexity. We analyze the set of use cases in the current SR drafts and we claim that PMSR can support the large majority of them. Thanks to the drastic simplification of the control plane, we have been able to develop an open source prototype of PMSR. In the second part of the paper, we consider a Traffic Engineering use case, starting from a traditional flow assignment optimization problem, which allocates hop-by-hop paths to flows. We propose a SR path assignment algorithm and prove that it is optimal with respect to the number of segments allocated to a flow.

The introduction of SDN in large-scale IP provider networks is still an open issue and different solutions have been suggested so far. In this paper, we propose a hybrid approach that allows the coexistence of traditional IP routing with SDN based forwarding within the same provider domain. The solution is called OSHI-Open Source Hybrid IP/SDN networking, as we have fully implemented it combining and extending open source software. We discuss the OSHI system architecture and the design and implementation of advanced services like pseudo wires and virtual switches. In addition, we describe a set of open source management tools for the emulation of the proposed solution using either the Mininet emulator or distributed physical testbeds. We refer to this suite of tools as Mantoo (management tools). Mantoo includes an extensible Web-based graphical topology designer, which provides different layered network “views” (e.g., from physical links to service relationships among nodes). The suite can validate an input topology, automatically deploy it over a Mininet emulator or a distributed SDN testbed and allows access to emulated nodes by opening consoles in the web GUI. Mantoo provides also tools to evaluate the performance of the deployed nodes.

Several Network Operating Systems have been proposed in the last few years for Software Defined Networks; however, only few of them are offering resiliency, scalability and high availability required for production environments. In our demonstration we present a geographically distributed SDN Control Plane, called ICONA, build on top of the Open Networking Operating System (ONOS) and designed to meet the aforementioned Service Providers requirements. During the demo, that runs inside the GEANT OpenFlow pan-european testbed, we show how a Service Provider engineer can easily manage and monitor the network, deploy some services and how ICONA can automatically recover from Control and Data planes failures.