Author: Yi Lu, Balaji PrabhakarPublisher: INFOCOM’09Presenter: Yun-Yan ChangDate: 2011/11/2

1

Previous work

Space-efficient approximate flow label collection

Error-resilient message passing decoder

Evaluation

2

Counter braids

: 2

: 24

: 3

: 1

: 3

: 2

3

Standard Bloom Filter (SBF)◦ A m-bit vector B◦ Use k hash functions h1(.),…, hk(.)

◦ Insert: Set the h1(x)th, …, h1(x)th bit of bit-vector to “1”.

Bloom filter with Variable-length Signature (VBF)◦ Insert: set t (k) bits to “1”.◦ Query: a flow is valid if at least q (k) bits are set to “1”

in bit-vecotr B.◦ Delete: unset kd bits of a flow’s signature (d < q)

4

Problem◦ Collect the flow labels for each measurement epoch.◦ Memory resource constrains of recording flow labels.

Approximate solution◦ Identify flows by VLSC (variable-length signature

counting) Bloom filters in SRAM.◦ Store the flow labels in off-chip DRAM.

5

Flowchart◦ All collected flow labels are

stored in DRAM.◦ BF1: identify TCP flows.◦ BF2: identify non-TCP flows. ◦ Three paths to DRAM

Corresponds to a TCP “SYN” packet, recorded in DRAM directly and insert to BF1.

Corresponds to TCP packets that is not “SYN”.

Corresponds to non-TCP packets.

Fig. 4. Flow label collection using VLSC Bloom filters

6

Problem when decoding: Missing flow labels◦ Result from packets of a flow being false positives in BF1.◦ Cause a problem when decoding.

Fig. 3. Layer-1 decoding graph with missing flow labels.

The top figure shows the actual flows and corresponding counts, with dashed lines indicating contribution from the missing flow.

The bottom figure shows the actual decoding graph and noise in counters due to the missing flow.

7

To decode when some flow labels are missing. Algorithm

8

InitializeIteration 1Iteration 2

c 1 = 1

c 2 = 33

c 3 = 35

c 4 = 329

μ11(1) = max{c1-0,1} = 1μ21(1) = max{c2- ν22(0), 1} = 33μ22(1) = max{c2- ν12(0), 1} = 33μ31(1) = max{c3- ν23(0), 1} = 35μ32(1) = max{c3- ν13(0), 1} = 35μ42(1) = max{c4- 0, 1} = 32v11 (1) = min{μ21(1), μ31(1)} = 33v12(1) = min {μ11(1), μ31(1)} = 1v13(1) = min {μ11(1), μ21(1)} = 1v22 (1) = min {μ32(1), μ42(1)} = 32v23 (1) = min {μ22(1), μ42(1)} = 32v24 (1) = min {μ22(1), μ32(1)} = 33

μ11(2) = max{c1-0,1} = 1μ21(2) = max{c2- ν22(1), 1} = 1μ22(2) = max{c2- ν12(1), 1} = 32μ31(2) = max{c3- ν23(1), 1} = 3μ32(2) = max{c3- ν13(1), 1} = 34μ42(2) = max{c4- 0, 1} = 32v11 (2) = min{μ21(2), μ31(2)} = 1v12(2) = min {μ11(2), μ31(2)} = 1v13(2) = min {μ11(2), μ21(2)} = 1v22 (2) = min {μ32(2), μ42(2)} = 32v23 (2) = min {μ22(2), μ42(2)} = 32v24 (2) = min {μ22(2), μ32(2)} = 32

ν11 ν12 ν13

ν22 ν23 ν24

μ11(3) = max{c1-0,1} = 1μ21(3) = max{c2- ν22(2), 1} = 1μ22(3) = max{c2- ν12(2), 1} = 32μ31(3) = max{c3- ν23(2), 1} = 3μ32(3) = max{c3- ν13(2), 1} = 34μ42(3) = max{c4- 0, 1} = 32

μ11

μ21 μ22

μ31 μ32

μ42

Iteration 3

flow node i

counternode a

10

InitializeIteration 1Iteration 2

c 1 = 1

c 2 = 33

c 3 = 35

c 4 = 32

μ11(1) = max{c1-0,1} = 1μ21(1) = max{c2- ν22(0), 1} = 33μ22(1) = max{c2- ν12(0), 1} = 33μ31(1) = max{c3- ν23(0), 1} = 35μ32(1) = max{c3- ν13(0), 1} = 35μ42(1) = max{c4- 0, 1} = 32v11 (1) = min{μ21(1), μ31(1)} = 33v12(1) = min {μ11(1), μ31(1)} = 1v13(1) = min {μ11(1), μ21(1)} = 1v22 (1) = min {μ32(1), μ42(1)} = 32v23 (1) = min {μ22(1), μ42(1)} = 32v24 (1) = min {μ22(1), μ32(1)} = 33

μ11(2) = max{c1-0,1} = 1μ21(2) = max{c2- ν22(1), 1} = 1μ22(2) = max{c2- ν12(1), 1} = 32μ31(2) = max{c3- ν23(1), 1} = 3μ32(2) = max{c3- ν13(1), 1} = 34μ42(2) = max{c4- 0, 1} = 32v11 (2) = max{μ21(2), μ31(2)} = 3v12(2) = max {μ11(2), μ31(2)} = 3v13(2) = max {μ11(2), μ21(2)} = 1v22 (2) = max {μ32(2), μ42(2)} = 34v23 (2) = max {μ22(2), μ42(2)} = 32v24 (2) = max {μ22(2), μ32(2)} = 34

μ11(3) = max{c1-0,1} = 1μ21(3) = max{c2- ν22(2), 1} = 1μ22(3) = max{c2- ν12(2), 1} = 30μ31(3) = max{c3- ν23(2), 1} = 3μ32(3) = max{c3- ν13(2), 1} = 34μ42(3) = max{c4- 0, 1} = 32

Iteration 3

ν11 ν12 ν13

ν22 ν23 ν24

μ11

μ21 μ22

μ31 μ32

μ42

flow node i

counternode a

Space-accuracy tradeoff of VLSC Bloom filters◦ Trace file:

5 million packet CAIDA trace (collected at 9:10 am, Aug 14, 2002)

11

12

Perr: reconstruction ErrorEm: average error magnitude

13

Perr: reconstruction ErrorEm: average error magnitude