WO2015004665A1

WO2015004665A1 - Microburst detection method and device

Info

Publication number: WO2015004665A1
Application number: PCT/IL2014/050619
Authority: WO
Inventors: Shamir STEIN; Eyal PROFETA
Original assignee: Fibrolan Ltd
Priority date: 2013-07-11
Filing date: 2014-07-10
Publication date: 2015-01-15
Also published as: IL227450A0

Abstract

The present invention relates to a method for detection of microbursts within network traffic, comprising the steps of- a) receiving data streams of burst packets being transmitted over the network; and b) analyzing said data streams by applying a "leaky bucket" algorithm to said data streams.

Description

MICROBURST DETECTION METHOD AND DEVICE

Field of the Invention

The present invention relates to the field of Ethernet performance monitoring sj'stems. More particularly, the invention relates to a method and system for detection of microburst events within network traffic.

Background of the invention

Ethernet service providers guarantee their premium customers a certain amount of bits per second— "throughput" to be delivered all the way to their destination, and charge them accordingly. Charging depends on the maximum throughput the customer is willing to pay for.

However, during congested periods of time, when a great part of the users are simultaneously transmitting bursts of data, the provider's equipment may reach a point where it is unable to handle the load and packets are being dropped and lost. This may happen even though all users limit their per-second average to the agreed upon throughput.

The consequences of such lost packets that do not get to their destination through the network, may have a major impact on applications that are extremely time sensitive such as financial or health applications. Therefore, such users need means to measure their "burstiness" which is the amount of bursts per second. The service provider on the other hand also needs such means to alert his customers when they are getting close to the limits of their agreed upon throughput.

Measuring such high speed data bursts with proper granularity can be performed by dedicated hardware systems such as the TipOff Network Analyzer made by Ta— Associates. Unfortunately, such hardware systems are relatively very expensive, very unique and require specific skills for their operation.

This microburst information is extremely useful for all service providers as it helps them better design and monitor their networks, and better allocate resources at critical points of their network, thus saving money while delivering a better service.

Therefore, it is an object of the present invention to provide a low cost system which is capable of detecting behavior associated with microbursts.

It is another object of the present invention to provide a system that can be implemented in existing Ethernet equipment.

Other objects and advantages of the invention will become apparent as the description proceeds. Summary of the Invention

According to an embodiment of the invention, the "leaky bucket" algorithm comprises ^:

a) Providing a configurable sliding window on a time axis for acting as a "leaky bucket" algorithm by loading a sliding "bucket" with a certain amount of "tokens" at each "time increment" and at the same time transmitted data is removing previous "tokens" out of said "bucket", wherein the amount of "tokens" being added to the sliding bucket at each "time increment" is the result of the predetermined throughput multiplied by said "time increment", wherein the amount of bits being transmitted at each such "time increment" is removed from the "leaky bucket"; or

b) Alternatively, the amount of bits being transmitted at each "time increment" is being added to the "bucket" at each "time increment", wherein at the same "time increment" the result of the predetermined throughput multiplied by the "time increment" is removed from the "bucket"; c) Every time said "bucket" is completely emptied (hits an "empty" condition), or alternatively, said bucket is completely filled up (and overflows), a microburst counter is being incremented; and d) The said microburst counter is periodically being retrieved. The value of said microburst counter, thereby determining the exact number of microbursts encountered during that period.

According to an embodiment of the invention, the "leaky bucket" algorithm is configured such that every elapsed "time increment" loads the sliding "bucket" with a certain amount of "tokens" and at the same time, transmitted data removes "tokens" out of said "bucket", wherein the amount of "tokens" being added to the sliding "bucket" at each "time increment" is the result of the predetermined throughput multiplied by said "time increment", wherein every time the bucket is completely emptied a microburst counter is incremented.

According to an embodiment of the invention, the "leaky bucket" algorithm is configured such that transmitted data loads "tokens" into the sliding "bucket", and at the same time, every elapsed "time increment" removes "tokens" out of the bucket, wherein the amount of "tokens" being removed from the "bucket" at each time increment is the result of the "time increment" multiplied by the predetermined throughput, wherein every time the bucket is completely filled up (and overflows) a microburst counter is incremented. According to an embodiment of the invention, the size of the bucket is determined hy the customer agreed upon throughput.

In another aspect, the present invention relates to a network device that in addition to its network oriented components it further comprises an integrated circuitry adapted to operate as a microburst detection unit by applying a leaky bucket algorithm.

Brief Description of the Drawings

In the drawings ·

Fig. 1 is a block diagram generally illustrating an embodiment of the invention; and

Figs. 2-3 are graphs generally illustrating the microburst detection method of the invention.

Detailed Description of the Invention

Throughout this description the term "microburst" is used to indicate an essentially short burst of packets being transmitted over the network at the "line rate", which is the maximum possible transmission speed over the medium, and with minimal spacing between these packets. The duration of such microbursts is in the order of milliseconds or even 100s of microseconds. Accordingly, the disclosure is not limited to any particular type of device, router, or switch. Also, although the disclosure discusses Ethernet network packet flows, those skilled in the art will realize that the invention can be used with all Packet based Protocols. This term does not imply any particular type of protocol, packet format or application, and invention is applicable to all suitable network systems.

Reference will now be made to several embodiments of the present invention, examples of which are illustrated in the accompanying figures. Wherever practicable similar or like reference numbers may be used in the figures and may indicate similar or like functionality. The figures depict embodiments of the present invention for purposes of illustration onry. One skilled in the art will readily recognize from the following description that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles of the invention described herein.

The terms, "for example", "e.g.", "optionally", as used herein, are intended to be used to introduce non-limiting examples. While certain references are made to certain example sj^stem components or services, other components and services can be used as well and/or the example components can be combined into fewer components and/or divided into further components. In addition, the example appearance and terminology as depicted and described herein, are intended to be illustrative and exemplary, and in no way limit the scope of the invention as claimed.

Fig. 1 shows a network device that can be used in conjunction with the invention. The network device illustrated in this figure is particularly convenient because a microburst detection unit can be applied to it without the need to carry out major alterations in its structure. The network device generally indicated by numeral 10 in the figure comprises a microburst detection unit 1 in addition to the common switching components, such as an input/output buffer 2, a switching matrix 3 and a controller 4. The microburst detection unit 1 analyses input and output data streams through its connection to the input/output buffer 2 as will be further explained hereinafter with respect to Fig. 2. For, example, the network device 10 can be any common Network Termination Unit (NTU) such as all Dual Hardware Core (DHC) Falcon series by FibroLAN. In this embodiment, the microburst detection unit 1 is used for microsecond granular SLA (Service-Level Agreement) monitoring.

Unless otherwise indicated, the functions of the microburst detection unit 1 as described herein may be performed by a programmable integrated circuitry, such as Field-Programmable Gate Array (FPGA). However, other state machines, and/or hardwired electronic circuits can also be utilized. Further, with respect to the example detection method described hereinafter, not all the process states need to be reached, nor do the states have to be performed in the illustrated order.

The network device 10 illustrated in Fig. 1 can include a switch, a router, etc., which are responsible for processing packets, e.g., incoming and outgoing network packet traffic. Usually, the network device 10 receives (at buffer 2) a number of input/output flows (as indicated by numeral 11) from various ports on the network. These flows each consist of multiple packets of data, in a variety of sizes and presented at a variety of rates. The network device 10 can be a carrier Ethernet demarcation/aggregation unit delivering Ethernet services and mobile backhaul over fiber infrastructure. Additionally, flows may be presented in different networking protocols, such as the TCP and the related UDP over which application protocols, such as FTP, Telnet, SIP, RTP, and HTTP are layered on top of. Many other internetworking protocols are also possible. As the reader will appreciate the ports receiving these flows can be on a network chip (e.g., application specific integrated circuit (ASICs)) and can include logic for the purpose of processing packets in each flow. The network chip may operate at Layer 2 and higher levels of TCP/IP protocol stack, e.g., logic link control/media access control-physical layers (MAC- PHY) and include logic circuitry associated therewith to achieve the embodiments described herein.

As the packets arrive they are buffered in an input/output buffer 2, which may be very high speed memory with the network chips or external random access memory (RAM). Buffering is accomplished according to the directives of the controller 4. The controller 4 can process packets, used in the network device's operation, which are received by network chips on the network device 10. The packet flows are switched at the switching matrix 3 and sent to the input/output buffer as indicated by numeral 2.

The microburst detection unit 1 can be implemented as one or more processors with associated interface circuitry and logic or can be implemented within a single FPGA to achieve the functions of the embodiments described herein.

Referring now to Figs. 2 and 3, according to an embodiment of the present invention, the microburst detection unit 1 utilizes a configurable sliding window 20 acting as a "Leaky Bucket" algorithm, as commonly used in packet switched computer networks and telecommunications networks to check data transmissions, in the form of packets. The microburst events are indicated by numeral 21 in the figures and each refers to a bandwidth utilization event above the threshold level (e.g., above 45Mbps as shown with respect to Fig. 3). The sampling time slot duration can be between few microseconds to few milliseconds (e.g., 10 microseconds to 10 milliseconds). For example, the network device 10 requires setting of the following parameters for detecting microbursts (see Fig. 3):

- Committed Information Rate (CIR) / Threshold level to monitor (e.g., 45MbpsWindow (Burst) size! and

- Sampling Timeslot duration (e.g., ΙΟμβ— 10ms). The traffic is monitored per timeslot for compliance with the CIR within the sliding window 20. If the threshold is crossed a microburst is reported on that second.

In this embodiment, the microburst detection involves the steps of

The size of the bucket is determined by the customer agreed upon throughput. As the window 20 is sliding on the time axis (see Fig. 2), transmitted data loads "tokens" into the bucket. At the same time, every elapsed "time increment" removes "tokens" out of the bucket. The amount of "tokens" being removed from the bucket at each time increment is the result of the "time increment" multiplied by the predetermined throughput. The predetermined throughput reflects the customer agreed upon throughput. Every time the bucket is completely filled up (and overflows) a microburst counter is incremented. The number stored in this counter is periodically retrieved (e.g., once a second as shown with respect to Fig. 3), and determines the exact number of microbursts encountered during that period. In another aspect of using the "leaky bucket" principles, the same result can be achieved using a bucket being emptied every time a microburst is being detected as hereby described:

- As the window 20 is sliding on the time axis (see Fig. 2), every elapsed "time increment" loads the "bucket" with a certain amount of "tokens" and at the same time, transmitted data removes "tokens" out of the "bucket".

- The amount of "tokens" being added to the sliding bucket at each time increment is the result of the "time increment" multiplied by the predetermined throughput. The predetermined throughput reflects the customer agreed upon throughput.

- Every time the bucket is completely emptied, an "empty" condition is declared and a microburst counter is incremented. The number stored in this counter is periodically retrieved (e.g., once a second - as shown with respect to Fig. 3), and determines the exact number of microbursts encountered during that period.

Clearry, the task of detecting and counting microbursts within a one- second interval, is no task for software, and requires dedicated hardware equipment (as described hereinabove with respect to the implementation of the microburst detection unit).

As will be appreciated by the skilled person the arrangement described in the figures results in a simple and non- expensive network termination equipment that is able to measure high speed data bursts (i.e., microburst) with proper granularity.

An additional advantage provided by the invention is that the microburst detection solution suggested by the present invention can be applied to almost every existing network termination unit.

Moreover, the microburst detection is extremely useful for all service providers as it helps them to better design and monitor their networks, and to better allocate resources at critical points of their network, thus saving money while delivering a better service.

All the above description and examples have been given for the purpose of illustration and are not intended to limit the invention in any way. Many different mechanisms, methods of analysis, electronic and logical elements can be employed, all without exceeding the scope of the claimed invention.

Claims

1. A method for detection of microbursts within network traffic, comprising the steps of

a) receiving data streams of burst packets being transmitted over the network; and

b) analyzing said data streams by applying a "leaky bucket" algorithm to said data streams.

2. A method according to claim 1, wherein the "leaky bucket" comprising:

a) providing a configurable sliding window on a time axis for acting as a "leaky bucket" algorithm by loading a sliding "bucket" with a certain amount of "tokens" at each "time increment" and at the same time transmitted data is removing previous "tokens" out of said "bucket", wherein the amount of "tokens" being added to the sliding bucket at each "time increment" is the result of a predetermined throughput multiplied by said "time increment"; and

b) every time said "bucket" is completely emptied (hits an "empty" condition), incrementing a microburst counter and periodically retrieving the value of said microburst counter, thereby determining the exact number of microbursts encountered during that period.

3. A method according to claim 1, wherein the "leaky bucket" algorithm is applied such that transmitted data loads "tokens" into the "leaky bucket" and at the same time every elapsed "time increment" removes "tokens" out of the "leaky bucket", wherein the amount of "tokens" being removed from the sliding "bucket" at each "time increment" is the result of the predetermined throughput multiplied by said "time increment", and wherein every time the bucket hits an "overflow" condition, a microburst counter is incremented and periodically retrieving the value of said microburst counter, thereby determining the exact number of microbursts encountered during that period.

4. A network device adapted for detection of microbursts within network traffic, comprising a) network oriented components! and b) an integrated circuitry adapted to operate as a microburst detection unit.

5. A network device according to claim 4, in which the microburst detection unit is configured to apply a "leaky bucket" algorithm on data streams of network traffic.