Microburst detection and management
Systems, methods, and apparatuses provide a scalable framework for analyzing queuing and transient congestion in network switches. The system reports which flows contributed to the queue buildup and enables direct per-packet action in the data plane to prevent transient congestion. The system may be configured to analyze queuing in legacy network switches.
1. A method for microburst detection and management, the method comprising:
obtaining within a period, by a network device, a plurality of packets, wherein the obtaining of the plurality of packets uses a snapshot-based data structure to take snapshots of data comprising the plurality of packets, wherein operations on each snapshot are performed independently across snapshots in parallel;
detecting, by the network device, congestion associated with the network device, wherein the congestion is a microburst congestion, wherein the microburst comprises a change of three times or more than an average traffic rate;
responsive to detecting the congestion, determining, by the network device, that a subset of the plurality of packets are in a congested queue when the congestion occurs;
based on the subset of the plurality of packets reaching a threshold percentage of packets in the congested queue when the congestion occurs, indicating, by the network device, an identifiable flow that is a culprit flow, wherein the identifiable flow comprises the subset of the plurality of packets; and
responsive to the identifiable flow being indicated as the culprit flow, controlling, by the network device, one or more actions.
2. The method of claim 1 , wherein the controlling of one or more actions comprises adjusting a quality of service of the network device associated with packets of the identifiable flow.
3. The method of claim 1 , wherein the controlling of one or more actions comprises dropping packets associated with the identifiable flow.
4. The method of claim 1 , wherein the controlling of one or more actions comprises load balancing packets of the identifiable flow.
5. The method of claim 1 , wherein the controlling of one or more actions comprises:
delaying packets of the identifiable flow; or
re-routing the packets of the identifiable flow to another route.
6. The method of claim 1 , wherein the network device is a switch.
7. A network device for microburst detection and management, the network device comprising:
a processor; and
a memory coupled with the processor, the memory storing executable instructions that when executed by the processor cause the processor to effectuate operations comprising:
obtaining within a period a plurality of packets, wherein the obtaining of the plurality of packets uses a snapshot-based data structure to take snapshots of data comprising the plurality of packets, wherein operations on each snapshot are performed independently across snapshots in parallel;
detecting congestion associated with a switch, wherein the congestion is a microburst congestion, wherein the microburst comprises a change of three times or more than an average traffic rate;
responsive to detecting the congestion, determining that a subset of the plurality of packets are in a congested queue when the congestion occurs;
based on the subset of the plurality of packets reaching a threshold percentage of packets in the congested queue when the congestion occurs, indicating an identifiable flow that is a culprit flow, wherein the identifiable flow comprises the subset of the plurality of packets; and
responsive to the identifiable flow being indicated as the culprit flow, controlling one or more actions associated with the culprit flow.
8. The network device of claim 7 , wherein the controlling of one or more actions comprises adjusting a quality of service of the switch associated with packets of the identifiable flow.
9. The network device of claim 7 , wherein the controlling of one or more actions comprises dropping packets associated with the identifiable flow.
10. The network device of claim 7 , wherein the controlling of one or more actions comprises load balancing packets of the identifiable flow.
11. The network device of claim 7 , wherein the controlling of one or more actions comprises:
delaying packets of the identifiable flow; or
re-routing the packets of the identifiable flow to another route.
12. A computer-readable storage medium storing computer executable instructions that when executed by a computing device cause said computing device to effectuate operations comprising:
obtaining within a period a plurality of packets, wherein the obtaining of the plurality of packets uses a snapshot-based data structure to take snapshots of data comprising the plurality of packets, wherein operations on each snapshot are performed independently across snapshots in parallel;
detecting congestion associated with a network device, wherein the congestion is a microburst congestion, wherein the microburst comprises a change of three times or more than an average traffic rate;
responsive to detecting the congestion, determining that a subset of the plurality of packets are in a congested queue when the congestion occurs;
based on the subset of the plurality of packets reaching a threshold percentage of packets in the congested queue when the congestion occurs, indicating an identifiable flow that is a culprit flow, wherein the identifiable flow comprises the subset of the plurality of packets; and
responsive to the identifiable flow being indicated as the culprit flow, controlling, one or more actions associated with the culprit flow.
13. The computer-readable storage medium of claim 12 , wherein the controlling of one or more actions comprises adjusting a quality of service of the network device associated with packets of the identifiable flow.
14. The computer-readable storage medium of claim 12 , wherein the controlling of one or more actions comprises dropping packets associated with the identifiable flow.
15. The computer-readable storage medium of claim 12 , wherein the controlling of one or more actions comprises delaying packets of the identifiable flow.
16. The computer-readable storage medium of claim 12 , wherein the controlling of one or more actions comprises re-routing the packets of the identifiable flow to another route.