Abstract:Ternary Content Addressable Memory (TCAM) is an essential hardware component in SDN-enabled switches, which supports fast lookup speed and flexible matching patterns. However, TCAM's limited storage capacity has long been a scalability challenge to enforce fine-grained forwarding policies in SDN. Based on the observation of traffic locality, the rule-caching mechanism employs a combination of TCAM and Random Access Memory (RAM) to maintain the forwarding rules of large and small flows, respectively. However, previous works cannot identify large flows timely and accurately, and suffer from high computational complexity when addressing rule dependencies in TCAM. Worse still, TCAM only caches the forwarding rules of large flows but ignores the latency requirements of small flows. Small flows encounter cache-miss in TCAM and then will be diverted to RAM, where they have to experience slow lookup processes. To jointly optimize the performance of both high-throughput large flows and latency-sensitive small flows, we propose a hybrid rule-caching framework, H-Cache, to scale traffic-aware forwarding policies in SDN. H-Cache identifies large flows through a collaboration of learning-based and threshold-based methods to achieve early detection and high accuracy, and proposes a time-efficient greedy heuristic to address rule dependencies. For small flows, H-Cache establishes default paths in TCAM to speed up their lookup processes, and also reduces their TCAM occupancy through label switching and region partitioning. Experiments with both real-world and synthetic datasets demonstrate that H-Cache increases TCAM utilization by an average of 11% and reduces the average completion time of small flows by almost 70%.

Source address filtering in large scale network: a cooperative software mechanism design

Source address filtering for large scale networks

Source Address Filtering For Large Scale Network: A Cooperative Software Mechanism Design

Multi-Gigabit Rate Pattern-Matching Engine Using Grouping CAM/TCAM

Multi-resource Max-Min Fairness and Support Vector Machine Based DDoS Defense

Optimal Filtering of Malicious IP Sources

A Distributed Cooperative Mechanism Of Software Based Network Security Filtering

A novel mechanism to defend against low-rate denial-of-service attacks

Towards a Cooperative Mechanism Based Distributed Source Address Filtering

Field domain segmentation approach to filter encoding for efficient packet classification with TCAM

A High-Speed Network Content Filtering System.

Random Spoofed Source Address Distributed Denial-of-Service Attack Traffic Filter

Scalable Double Filter Structure for Port Scan Detection.

Cam: A Counting Bloom Filter Based Attack Mitigation System For Sdn

T-Cache: Efficient Policy-Based Forwarding Using Small TCAM

An Encoding Scheme for TCAM-based Packet Classification

NetHCF: Filtering Spoofed IP Traffic with Programmable Switches

H-Cache: Traffic-Aware Hybrid Rule-Caching in Software-Defined Networks.

Internet Source Address Verification Method Based on Synchronization and Dynamic Filtering in Address Domain

Stateless Filtering Based on Enhanced Capabilities

A Coding-based Approach to Mitigate TCP Incast in Data Center Networks