Scaling-out traffic management in the cloud

Managing cloud traffic is challenging due to its large and constantly growing traffic in scale and traffic anomalies. Network infrastructure and traffic management need to scale their capacity to such traffic growth and anomalies, otherwise the application performance will suffer. Existing traffic management functions have so far focused on proprietary hardware appliances and software servers. However, with limited capacity and fixed functionality per box, those solutions incur a high cost, low performance and high management complexity. ❧ In this thesis, we argue that we should scale-out traffic management functions for the support of increasing traffic scale and anomalies. By scaling-out, we mean those traffic management functions should support the full throughput of datacenter networks. The key idea of this thesis is to leverage the hardware switches with line-rate packet processing and the emerging programmability to directly build advanced functionaries. We have identified three major traffic management functions: load balancing, attack mitigation, and congestion control. We present SilkRoad, a load balancer built directly in hardware switching ASICs, which provides a load balancing function at line-rate while keeps tracking of millions of connections. We then discuss the large-scale measurement study on the characteristics of network attacks for both coming towards and from the cloud. After we systematically analyze nine types of attacks and quantified their prevalence, intensive, and patterns, we advocate a cloud attack detection service called Nimbus to leverage hardware switches to select and filter traffic for accurate attack detection in virtual machines. Last, we present DIBS, a mechanism that allows switches to share their buffer for large buffer absorbing. We demonstrate that it reduces the 99th percentile of delay-sensitive query completion time by up to 85%, with very little impact on other traffic.