Sharing the data center network

TLDR

While today’s data centers multiplex many non‑cooperating applications, they lack effective means to share their network. We present Seawall, a network bandwidth allocation scheme that divides capacity according to an administrator‑specified policy. Seawall computes and enforces allocations by tunneling traffic through congestion‑controlled, point‑to‑multipoint, edge‑to‑edge tunnels. Experiments show that relying on TCP’s congestion control exposes data center networks to denial‑of‑service attacks and performance interference, whereas Seawall’s allocations remain stable across diverse traffic mixes, support dynamic policy changes, scale with application churn, add little overhead, and provide strong performance isolation.

Abstract

While today's data centers are multiplexed across many non-cooperating applications, they lack effective means to share their network. Relying on TCP's congestion control, as we show from experiments in production data centers, opens up the network to denial of service attacks and performance interference. We present Seawall, a network bandwidth allocation scheme that divides network capacity based on an administrator-specified policy. Seawall computes and enforces allocations by tunneling traffic through congestion controlled, point to multipoint, edge to edge tunnels. The resulting allocations remain stable regardless of the number of flows, protocols, or destinations in the application's traffic mix. Unlike alternate proposals, Seawall easily supports dynamic policy changes and scales to the number of applications and churn of today's data centers. Through evaluation of a prototype, we show that Seawall adds little overhead and achieves strong performance isolation.