CacheFlow: Dependency-Aware Rule-Caching forSoftware-Defined Networks

Naga Katta1, Omid Alipourfard2, Jennifer Rexford1 and David Walker1

1Princeton University ({nkatta,jrex,dpw}@cs.princeton.edu)2University of Southern California ({alipourf}@usc.edu)

ABSTRACTSoftware-Defined Networking (SDN) allows control appli-cations to install fine-grained forwarding policies in the un-derlying switches. While Ternary Content Addressable Mem-ory (TCAM) enables fast lookups in hardware switches withflexible wildcard rule patterns, the cost and power require-ments limit the number of rules the switches can support. Tomake matters worse, these hardware switches cannot sus-tain a high rate of updates to the rule table. In this pa-per, we show how to give applications the illusion of high-speed forwarding, large rule tables, and fast updates by com-bining the best of hardware and software processing. OurCacheFlow system “caches” the most popular rules in thesmall TCAM, while relying on software to handle the smallamount of “cache miss” traffic. However, we cannot blindlyapply existing cache-replacement algorithms, because of de-pendencies between rules with overlapping patterns. Ratherthan cache large chains of dependent rules, we “splice” longdependency chains to cache smaller groups of rules whilepreserving the semantics of the policy. Experiments withour CacheFlow prototype—on both real and synthetic work-loads and policies—demonstrate that rule splicing makes ef-fective use of limited TCAM space, while adapting quicklyto changes in the policy and the traffic demands.

1. INTRODUCTIONIn a Software-Defined Network (SDN), a logically cen-

tralized controller manages the flow of traffic by in-stalling simple packet-processing rules in the underlyingswitches. These rules can match on a wide variety ofpacket-header fields, and perform simple actions suchas forwarding, flooding, modifying the headers, and di-recting packets to the controller. This flexibility al-lows SDN-enabled switches to behave as firewalls, serverload balancers, network address translators, Ethernetswitches, routers, or anything in between. However,fine-grained forwarding policies lead to a large numberof rules in the underlying switches.

In modern hardware switches, these rules are storedin Ternary Content Addressable Memory (TCAM) [1].A TCAM can compare an incoming packet to the pat-

terns in all of the rules at the same time, at line rate.However, commodity switches support relatively fewrules, in the small thousands or tens of thousands [2].Undoubtedly, emerging switches will support larger ruletables , but TCAMs still introduce a fundamental trade-off between rule-table size and other concerns like costand power. TCAMs introduce around 100 times greatercost [3] and 100 times greater power consumption [4],compared to conventional RAM. Plus, updating therules in TCAM is a slow process—today’s hardwareswitches only support around 40 to 50 rule-table up-dates per second [5, 6], which could easily constrain alarge network with dynamic policies.

Software switches may seem like an attractive alter-native. Running on commodity servers, software switchescan process packets at around 40 Gbps on a quad-core machine [7–9] and can store large rule tables inmain memory and (to a lesser extent) in the L1 and L2cache. In addition, software switches can update therule table more than ten times faster than hardwareswitches [6]. But, supporting wildcard rules that matchon many header fields is taxing for software switches,which must resort to slow processing (such as a linearscan) in user space to handle the first packet of eachflow [10]. So, they cannot match the “horsepower” ofhardware switches that provide hundreds of Gbps ofpacket processing (and high port density).

Fortunately, traffic tends to follow a Zipf distribu-tion, where the vast majority of traffic matches a rela-tively small fraction of the rules [11]. Hence, we couldleverage a small TCAM to forward the vast majorityof traffic, and rely on software switches for the remain-ing traffic. For example, an 800 Gbps hardware switch,together with a single 40 Gbps software packet proces-sor could easily handle traffic with a 5% “miss rate” inthe TCAM. In addition, most rule-table updates couldgo to the slow-path components, while promoting verypopular rules to hardware relatively infrequently. To-gether, the hardware and software processing would givecontroller applications the illusion of high-speed packetforwarding, large rule tables, and fast rule updates.

Figure 1: CacheFlow architecture

Our CacheFlow architecture consists of a TCAM anda sharded collection of software switches, as shown inFigure 1. The software switches can run on CPUs inthe data plane (e.g., network processors), as part of thesoftware agent on the hardware switch, or on separateservers. CacheFlow consists of a CacheMaster mod-ule that receives OpenFlow commands from an unmod-ified SDN controller. CacheMaster preserves the se-mantics of the OpenFlow interface, including the abil-ity to update rules, query counters etc. CacheMasteruses the OpenFlow protocol to distribute rules to un-modified commodity hardware and software switches.CacheMaster is a purely control-plane component, withcontrol sessions shown as dashed lines and data-planeforwarding shown by solid lines.

As the name suggests, CacheFlow treats the TCAMas a cache that stores the most popular rules. However,we cannot simply apply existing cache-replacement al-gorithms, because the rules can match on overlappingsets of packets, leading to dependencies between mul-tiple rules. Indeed, the switch we used for our exper-iments makes just this mistake (See §5) — a bug nowaddressed by our new system! Moreover, while earlierwork on IP route caching [11–14] considered rule depen-dencies, IP prefixes only have simple “containment” re-lationships, rather than patterns that partially overlap.The partial overlaps can also lead to long dependencychains, and this problem is exacerbated by applicationsthat combine multiple functions (like server load bal-ancing and routing, as can be done in Frenetic [15] andCoVisor [16]) to generate many more rules.

To handle rule dependencies, we construct a compactrepresentation of the given prioritized list of rules asan annotated directed acyclic graph (DAG), and de-sign incremental algorithms for adding and removingrules to this data structure. Our cache-replacement al-gorithms use the DAG to decide which rules to place inthe TCAM. To preserve rule-table space for the rulesthat match a large fraction of the traffic, we design anovel “splicing” technique that breaks long dependencychains. Splicing creates a few new rules that “cover” alarge number of unpopular rules, to avoid polluting the

cache. The technique extends to handle changes in therules, as well as changes in their popularity over time.

In summary, we make the following key technical con-tributions:

• Incremental rule-dependency analysis: Wedevelop an algorithm for incrementally analyzingand maintaining rule dependencies.

• Novel cache-replacement strategies: We de-velop new algorithms that only cache heavy-hittingrules along with a small set of dependencies.

• Implementation and evaluation: We discusshow CacheFlow preserves the semantics of the Open-Flow interface. Our experiments on both syntheticand real workloads show a cache-hit rate of 90%of the traffic by caching less than 5% of the rules.

A preliminary version of this work appeared in a work-shop paper [17] which briefly discussed ideas about ruledependencies and caching algorithms. In this paper,we develop novel algorithms that help efficiently dealwith practical deployment constraints like incrementalupdates to policies and high TCAM update times. Wealso evaluate CacheFlow by implementing large policieson actual hardware as opposed to simulations done us-ing much smaller policies in the workshop version.

2. IDENTIFYING RULE DEPENDENCIESIn this section, we show how rule dependencies affect

the correctness of rule-caching techniques and wheresuch dependencies occur. We show how to representcross-rule dependencies as a graph, and present efficientalgorithms for incrementally computing the graph.

2.1 Rule DependenciesThe OpenFlow policy on a switch consists of a set of

packet-processing rules. Each rule has a pattern, a pri-ority, a set of actions, and counters. When a packet ar-rives, the switch identifies the highest-priority matchingrules, performs the associated actions and incrementsthe counters. CacheFlow implements these policies bysplitting the set of rules into two groups—one residingin the TCAM and another in a software switch.

The semantics of CacheFlow is that (1) the highest-priority matching rule in the TCAM is applied, if sucha rule exists, and (2) if no matching rule exists in theTCAM, then the highest-priority rule in the softwareswitch is applied. As such, not all splits of the set ofrules lead to valid implementations. If we do not cacherules in the TCAM correctly, packets that should hitrules in the software switch may instead hit a cachedrule in the TCAM, leading to incorrect processing.

In particular, dependencies may exist between ruleswith differing priorities, as shown in the example in Fig-ure 2(a). If the TCAM can store four rules, we cannot

2

(a) Example rule table (b) Incremental DAG insert (c) Incremental DAG delete

Figure 2: Constructing the rule dependency graph (edges annotated with reachable packets)

select the four rules with highest traffic volume (i.e., R2,R3, R5, and R6), because packets that should matchR1 (with pattern 000) would match R2 (with pattern00*); similarly, some packets (say with header 110) thatshould match R4 would match R5 (with pattern 1*0).That is, rules R2 and R5 depend on rules R1 and R4,respectively. In other words, there is a dependency fromrule R1 to R2 and from rule R4 to R5. If R2 is cachedin the TCAM, R1 should also be cached to preserve thesemantics of the policy, similarly with R5 and R4.

A direct dependency exists between two rules if thepatterns in the rules intersect (e.g., R2 is dependent onR1). When a rule is cached in the TCAM, the cor-responding dependent rules should also move to theTCAM. However, simply checking for intersecting pat-terns does not capture all of the policy dependencies.For example, going by this definition, the rule R6 onlydepends on rule R5. However, if the TCAM storedonly R5 and R6, packets (with header 110) that shouldmatch R4 would inadvertently match R5 and hencewould be incorrectly processed by the switch. In thiscase, R6 also depends indirectly on R4 (even thoughthe matches of R4 and R6 do not intersect), becausethe match for R4 overlaps with that of R5.

2.2 Where do complex dependencies arise?Partial overlaps. Complex dependencies do not

arise in traditional destination prefix forwarding be-cause a prefix is dependent only on prefixes that arestrict subsets of itself (nothing else). However, in anOpenFlow rule table, where rules have priorities and canmatch on multiple header fields, indirect dependenciesoccur because of partial overlaps between rules—bothR4 and R6 only partially overlap with R5. Hence, eventhough R4 and R6 do not have a direct dependency,they have an indirect dependency due to R5’s own de-pendence on R6. The second column of Figure 2(a)illustrates such a situation. Here, one might interpretthe first two bits of R4, R5, and R6 as matching a des-tination IP, and the last bit as matching a port.Policy composition. Frenetic [15], Pyretic [18],

CoVisor [16] and other high-level SDN programmingplatforms support abstractions for constructing com-plex network policies from a collection of simpler com-

ponents. While the separate components may exhibitfew dependencies, when they are compiled together, thecomposite rule tables may contain many complex de-pendencies. For instance, Figure 3(c) presents an illus-trative rule table drawn from the CoVisor project [16].The corresponding dependency graph for the rules isshown in Figure 3(d). Here, the dependency betweenrules R3 and R4 was not seen in the two separate com-ponents that defined the high-level policy, but does arisewhen they are composed.Dependencies in REANNZ policies. We also an-

alyzed a number of policies drawn from real networksto determine the nature of the dependencies they ex-hibit. As an example, Figure 3(a) shows part of an OFpolicy in use at the REANNZ research network [19].The corresponding dependency graph can be seen inFigure 3(b). Now, one might conjecture that a networkoperator could manually rewrite the policy to reduce thenumber of dependencies and thereby facilitate caching.However, doing so is bound to be extremely tedious andhighly error prone. Moreover, a good split may dependon the dynamic properties of network traffic. We arguethat such tasks are much better left to algorithms, suchas the ones we propose in this paper. An expert candevelop a single caching algorithm, validate it and thendeploy it on any policy. Such a solution is bound to bemore reliable than asking operators to manually rewritepolicies.Is this a temporary problem? Even if the TCAM

available on future switches grows, network operatorswill only become greedier in utilizing these resources— in the same way that with increasing amounts ofDRAM, user applications have begun to consume in-creasing amounts of memory in conventional comput-ers. Newer switches have multi-table pipelines [20] thatcan help avoid rule blowup from policy compositionbut the number of rules is still limited by the availableTCAM. Our algorithms can be used to cache rules inde-pendently in each table (which maximizes the cache-hittraffic across all tables). Further, even high-end soft-ware switches like the OpenVSwitch (OVS) spend con-siderable effort [10] to cache popular OF rules in the ker-nel so that majority of the traffic does not get processedby the user-level classifier which is very slow. Thus, the

3

(a) Reanzz Rule Table (b) Reanzz Subgraph (c) CoVisor Example Table (d) CoVisor Example Graph

Figure 3: Dependent-set vs. cover-set algorithms (L0 cache rules in red)

rise of software switches may not completely avoid theproblem of correctly splicing policies to cache them inthe faster classifier process. Thus we believe our effortsare widely applicable and are going to be relevant in thelong term despite the near term industry trends.

2.3 Constructing the Dependency DAG

Algorithm 1: Building the dependency graph// Add dependency edges

1 func addParents(R:Rule, P:Parents) begin2 deps = (∅);

// p.o : priority order3 packets = R.match;4 for each Rj in P in descending p.o: do5 if (packets ∩ Rj .match) != ∅ then6 deps = deps ∪ {(R,Rj)};7 reaches(R,Rj) = packets ∩ Rj ;8 packets = packets - Rj .match;

9 return deps;

10 for each R:Rule in Pol:Policy do11 potentialParents = [Rj in Pol | Rj .p.o ≤ R.p.o];12 addParentEdges(R, potentialParents);

A concise way to capture all the dependencies in arule table is to construct a directed graph where eachrule is a node, and each edge captures a direct depen-dency between a pair of rules as shown in Figure 2(b).A direct dependency exists between a child rule Ri anda parent rule Rj under the following condition—if Ri isremoved from the rule table, packets that are supposedto hit Ri will now hit rule Rj . The edge between therules in the graph is annotated by the set of packets thatreach the parent from the child. Then, the dependen-cies of a rule consist of all descendants of that rule (e.g.,R1 and R2 are the dependencies for R3). The rule R0

is the default match-all rule (matches all packets withpriority 0) added to maintain a connected rooted graphwithout altering the overall policy.

To identify the edges in the graph, for any given childrule R, we need to find out all the parent rules that thepackets matching R can reach. This can be done bytaking the symbolic set of packets matching R and iter-ating them through all of the rules with lower prioritythan R that the packets might hit.

To find the rules that depend directly on R, Algo-rithm 1 scans the rules Ri with lower priority than R(line 14) in order of decreasing priority. The algorithm

keeps track of the set of packets that can reach eachsuccessive rule (the variable packets). For each suchnew rule, it determines whether the predicate associ-ated with that rule intersects1 the set of packets thatcan reach that rule (line 5). If it does, there is a de-pendency. The arrow in the dependency edge pointsfrom the child R to the parent Ri. In line 7, the depen-dency edge also stores the packet space that actuallyreaches the parent Ri. In line 8, before searching forthe next parent, because the rule Ri will now occludesome packets from the current reaches set, we subtractRi’s predicate from it.

This compact data structure captures all dependen-cies because we track the flow of all the packets thatare processed by any rule in the rule table. The datastructure is a directed acyclic graph (DAG) because ifthere is an edge from Ri to Rj then the priority of Ri

is always strictly greater than priority of Rj . Note thatthe DAG described here is not a topological sort (weare not imposing a total order on vertices of a graphbut are computing the edges themselves). Once sucha dependency graph is constructed, if a rule R is tobe cached in the TCAM, then all the descendants ofR in the dependency graph should also be cached forcorrectness.

2.4 Incrementally Updating The DAGAlgorithm 1 runs in O(n2) time where n is the num-

ber of rules. As we show in Section 6, running the staticalgorithm on a real policy with 180K rules takes around15 minutes, which is unacceptable if the network needsto push a rule into the switches as quickly as possible(say, to mitigate a DDoS attack). Hence we describean incremental algorithm that has considerably smallerrunning time in most practical scenarios—just a fewmilliseconds for the policy with 180K rules.

Figure 2(b) shows the changes in the dependencygraph when the rule R5 is inserted. All the changesoccur only in the right half of the DAG because theleft half is not affected by the packets that hit the newrule. A rule insertion results in three sets of updatesto the DAG: (i) existing dependencies (like (R4,R0))change because packets defining an existing dependencyare impacted by the newly inserted rule, (ii) creation

1Symbolic intersection and subtraction of packets can bedone using existing techniques [21].

4

Algorithm 2: Incremental DAG insert1 func FindAffectedEdges(rule, newRule) begin2 for each C in Children(rule) do3 if Priority(C) > priority(newRule) then4 if reaches(C,rule) ∩ newRule.match != ∅ then5 reaches(C, rule) -= newRule.match;6 add (C, Node) to affEdges

7 else8 if Pred(C) ∪ newRule.match != ∅ then9 add C to potentialParents;

10 FindAffectedEdges(C, newRule);

11 func processAffectedEdges(affEdges) begin12 for each childList in groupByChild(affEdges) do13 deps = deps ∪ {(child, newRule)};14 edgeList = sortByParent(childList);15 reaches(child, newRule) = reaches(edgeList[0]);

16 func Insert(G=(V, E), newNode) begin17 affEdges = { };18 potentialParents = [R0];19 FindAffectedEdges(R0, newNode);20 ProcessAffectedEdges(affEdges);21 addParents(newNode, potentialParents);

of dependencies with the new rule as the parent (like(R4,R5)) because packets from old rules (R4) are nowhitting the new rule (R5), and (iii) creation of depen-dencies (like (R5,R6)) because the packets from the newrule (R5) are now hitting an old rule (R6). Algorithm 1takes care of all three dependencies by it rebuilding alldependencies from scratch. The challenge for the in-cremental algorithm is to do the same set of updateswithout touching the irrelevant parts of the DAG — Inthe example, the left half of the DAG is not affected bypackets that hit the newly inserted rule.

2.4.1 Incremental InsertIn the incremental algorithm, the intuition is to use

the reaches variable (packets reaching the parent fromthe child) cached for each existing edge to recursivelytraverse only the necessary edges that need to be up-dated. Algorithm 2 proceeds in three phases:(i) Updating existing edges (lines 1–10): While

finding the affected edges, the algorithm recursively tra-verses the dependency graph beginning with the defaultrule R0. It checks if the newRule intersects any edgebetween the current node and its children. It updatesthe intersecting edge and adds it to the set of affectededges (line 4). However, if newRule is higher in the pri-ority chain, then the recursion proceeds exploring theedges of the next level (line 9). It also collects the rulesthat could potentially be the parents as it climbs up thegraph (line 8). This way, we end up only exploring therelevant edges and rules in the graph.(ii) Adding directly dependent children (lines

11-15): In the second phase, the set of affected edgescollected in the first phase are grouped by their children.For each child, an edge is created from the child to the

Algorithm 3: Incremental DAG delete1 func Delete(G=(V, E), oldRule) begin2 for each c in Children(oldRule) do3 potentialParents = Parents(c) - {oldRule};4 for each p in Parents(oldRule) do5 if reaches(c, oldRule) ∩ p.match != ∅ then6 add p to potentialParents

7 addParents(C, potentialParents)

8 Remove all edges involving oldRule

newRule using the packets from the child that used toreach its highest priority parent (line 14). Thus all theedges from the new rule to its children are created.(iii) Adding directly dependent parents (line

21): In the third phase, all the edges that have newRuleas the child are created using the addParents methoddescribed in Algorithm 1 on all the potential parentscollected in the first phase.

In terms of the example, in phase 1, the edge (R4,R0) is the affected edge and is updated with reachesthat is equal to 111 (11* - 1*0). The rules R0 and R6

are added to the new rule’s potential parents. In phase2, the edge (R4,R5) is created. In phase 3, the functionaddParents is executed on parents R6 and R0. Thisresults in the creation of edges (R5,R6) and (R5,R0).Running Time: Algorithm 2 clearly avoids traversing

the left half of the graph which is not relevant to the newrule. While in the worst case, the running time is linearin the number of edges in the graph, for most practicalpolicies, the running time is linear in the number ofclosely related dependency groups2.

2.4.2 Incremental DeleteThe deletion of a rule leads to three sets of updates to

a dependency graph: (i) new edges are created betweenother rules whose packets used to hit the removed rule,(ii) existing edges are updated because more packetsare reaching this dependency because of the absence ofthe removed rule, and (iii) finally, old edges having theremoved rule as a direct dependency are deleted.

For the example shown in Figure 2(c), where therule R5 is deleted from the DAG, existing edges (like(R4,R0)) are updated and all three involving R5 are cre-ated. In this example, however, no new edge is created.But it is potentially possible in other cases (considerthe case where rule R2 is deleted which would result ina new edge between R1 and R3).

An important observation is that unlike an incremen-tal insertion (where we recursively traverse the DAGbeginning with R0), incremental deletion of a rule canbe done local to the rule being removed. This is be-cause all three sets of updates involve only the children2Since the dependency graph usually has a wide bush of iso-lated prefix dependency chains—like the left half and righthalf in the example DAG—which makes the insertion costequal to the number of such chains.

5

(a) Dependent Set Algo. (b) Cover Set Algo. (c) Mixed Set Algo

Figure 4: Dependent-set vs. cover-set algorithms (L0 cache rules in red)

or parents of the removed rule. For example, a newedge can only be created between a child and a parentof the removed rule3.

Algorithm 3 incrementally updates the graph whena new rule is deleted. First, in lines 2-6, the algorithmchecks if there is a new edge possible between any child-parent pair by checking whether the packets on the edge(child, oldRule) reach any parent of oldRule (line 5).Second, in lines 3 and 7, the algorithm also collects theparents of all the existing edges that may have to beupdated (line 3). It finally constructs the new set ofedges by running the addParents method described inAlgorithm 1 to find the exact edges between the childc and its parents (line 7). Third, in line 8, the rulesinvolving the removed rule as either a parent or a childare removed from the DAG.Running time: This algorithm is dominated by the

two for loops (in lines 2 and 4) and may also have aworst case O(n2) running time (where n is the numberof rules) but in most practical policy scenarios, the run-ning time is much smaller (owing to the small numberof children/parents for any given rule in the DAG).

3. CACHING ALGORITHMSIn this section, we present CacheFlow’s algorithm for

placing rules in a TCAMwith limited space. CacheFlowselects a set of important rules from among the rulesgiven by the controller to be cached in the TCAM, whileredirecting the cache misses to the software switches.

We first present a simple strawman algorithm to buildintuition, and then present new algorithms that avoidscaching low-weight rules. Each rule is assigned a “cost”corresponding to the number of rules that must be in-stalled together and a “weight” corresponding to thenumber of packets expected to hit that rule 4. Contin-uing with the running example from the previous sec-tion, R6 depends on R4 and R5, leading to a cost of

3A formal proof is omitted for lack of space and is left forthe reader to verify. In the example where R2 is deleted,a new rule can only appear between R1 and R3. Similarlywhen R5 is deleted, a new rule could have appeared betweenR4 and R6 but does not because the rules do not overlap.4In practice, weights for rules are updated in an online fash-ion based on the packet count in a sliding window of time.

3, as shown in Figure 4(a). In this situation, R2 andR6 hold the majority of the weight, but cannot be in-stalled simultaneously on a TCAM with capacity 4, asinstalling R6 has a cost of 3 and R2 bears a cost of 2.Hence together they do not fit. The best we can do is toinstall rules R1, R4, R5, and R6 which maximizes totalweight, subject to respecting all dependencies.

3.1 Optimization: NP HardnessThe input to the rule-caching problem is a depen-

dency graph of n rules R1, R2, . . . , Rn, where rule Ri

has higher priority than rule Rj for i < j. Each rulehas a match and action, and a weight wi that capturesthe volume of traffic matching the rule. There are de-pendency edges between pairs of rules as defined in theprevious section. The output is a prioritized list of Crules to store in the TCAM5. The objective is to maxi-mize the sum of the weights for traffic that “hits” in theTCAM, while processing “hit” packets according to thesemantics of the original rule table.

Maximize

n∑i=1

wici

subject ton∑

i=1

ci ≤ C; ci ∈ {0, 1}

ci − cj ≥ 0 if Ri.is_descendant(Rj)

The above optimization problem is NP-hard in n andk. It can be reduced from the densest k-subgraph prob-lem which is known to be NP-hard. We outline a sketchof the reduction here between the decision versions ofthe two problems. Consider the decision problem forthe caching problem - Is there a subset of C rules fromthe rule table which respect the directed dependenciesand have a combined weight of atleast W . The decisionproblem for the densest k-subgraph problem is to askif there is a subgraph incident on k vertices that hasat least d edges in a given undirected graph G=(V,E)(This generalizes the well known CLIQUE problem ford=

(k2

), hence is hard).

5Note that CacheFlow does not simply install rules on acache miss. Instead, CacheFlow makes decisions based ontraffic measurements over the recent past. This is importantto defend against cache-thrashing attacks where an adver-sary generates low-volume traffic spread across the rules.

6

Figure 5: Reduction from densest k-subgraph

Consider the reduction shown in Figure 5. For a giveninstance of the densest k-subgraph problem with param-eters k and d, we construct an instance of the cache-optimization problem in the following manner. Let thevertices ofG′ be nodes indexed by the vertices and edgesof G. The edges of G′ are constructed as follows : for ev-ery undirected edge e = (vi, vj) in G, there is a directededge from e to vi and vj . This way, if e is chosen to in-clude in the cache, vi and vj should also be chosen. Nowwe assign weights to nodes in V ′ as follows : w(v) = 1for all v ∈ V and w(e) = n + 1 for all e ∈ E. Now letC = k + d and W = d(n + 1). If you can solve thisinstance of the cache optimization problem, then youhave to choose at least d of the edges e ∈ E becauseyou cannot reach the weight threshold with less than dedge nodes (since their weight is much larger than nodesindexed by V ). Since C cannot exceed d + k, becauseof dependencies, one will also end up choosing less thenk vertices v ∈ V to include in the cache. Thus this willsolve the densest k-subgraph instance.

3.2 Dependent-Set: Caching Dependent RulesNo polynomial time approximation scheme (PTAS)

is known yet for the densest k-subgraph problem. Itis also not clear whether a PTAS for our optimizationproblem can be derived directly from a PTAS for thedensest subgraph problem. Hence, we use a heuristicthat is modeled on a greedy PTAS for the BudgetedMaximum Coverage problem [22] which is similar tothe formulation of our problem. In our greedy heuris-tic, at each stage, the algorithm chooses a set of rulesthat maximizes the ratio of combined rule weight tocombined rule cost (∆W

∆C ), until the total cost reachesk. This algorithm runs in O(nk) time.

On the example rule table in Figure 4(a), the greedyalgorithm selectsR6 first (and its dependent set {R4, R5}),and then R1 which brings the total cost to 4. Thusthe set of rules in the TCAM are R1, R4, R5, and R6

which is the optimal. We refer to this algorithm as thedependent-set algorithm.

3.3 Cover-Set: Splicing Dependency ChainsRespecting rule dependencies can lead to high costs,

especially if a high-weight rule depends on many low-weight rules. For example, consider a firewall that has asingle low-priority “accept” rule that depends on manyhigh-priority “deny” rules that match relatively little

(a) Dep. Set Cost (b) Cover Set Cost

Figure 6: Dependent-set vs. cover-set Cost

traffic. Caching the one “accept” rule would requirecaching many “deny” rules. We can do better than pastalgorithms by modifying the rules in various semantics-preserving ways, instead of simply packing the existingrules into the available space—this is the key observa-tion that leads to our superior algorithm. In particular,we “splice” the dependency chain by creating a smallnumber of new rules that cover many low-weight rulesand send the affected packets to the software switch.

For the example in Figure 4(a), instead of selectingall dependent rules for R6, we calculate new rules thatcover the packets that would otherwise incorrectly hitR6. The extra rules direct these packets to the soft-ware switches, thereby breaking the dependency chain.For example, we can install a high-priority rule R∗5 withmatch 1*1* and action forward_to_Soft_switch,6 alongwith the low-priority rule R6. Similarly, we can createa new rule R∗1 to break dependencies on R2. We avoidinstalling higher-priority, low-weight rules like R4, andinstead have the high-weight rules R2 and R6 inhabitthe cache simultaneously, as shown in Figure 4(b).

More generally, the algorithm must calculate the coverset for each rule R. To do so, we find the immediateancestors of R in the dependency graph and replace theactions in these rules with a forward_to_Soft_Switchaction. For example, the cover set for rule R6 is therule R∗5 in Figure 4(b); similarly, R∗1 is the cover set forR2. The rules defining these forward_to_Soft_switchactions may also be merged, if necessary.7 The cardi-nality of the cover set defines the new cost value foreach chosen rule. This new cost is strictly less than orequal to the cost in the dependent set algorithm. Thenew cost value is much less for rules with long chains ofdependencies. For example, the old dependent set costfor the rule R6 in Figure 4(a) is 3 as shown in the rulecost table whereas the cost for the new cover set for R6

in Figure 4(b) is only 2 since we only need to cache R∗5and R6. To take a more general case, the old cost forthe red rule in Figure 6(a) was the entire set of ances-6This is just a standard forwarding action out some portconnected to a software switch.7To preserve OpenFlow semantics pertaining to hardwarepacket counters, policy rules cannot be compressed. How-ever, we can compress the intermediary rules used for for-warding cache misses, since the software switch can trackthe per-rule traffic counters.

7

tors (in light red), but the new cost (in Figure 6(b)) isdefined just by the immediate ancestors (in light red).

3.4 Mixed-Set: An Optimal MixtureDespite decreasing the cost of caching a rule, the

cover-set algorithm may also decrease the weight byredirecting the spliced traffic to the software switch.For example, for caching the rule R2 in Figure 4(c),the dependent-set algorithm is a better choice becausethe traffic volume processed by the dependent set in theTCAM is higher, while the cost is the same as a coverset. In general, as shown in Figure 6(b), cover set seemsto be a better choice for caching a higher dependencyrule (like the red node) compared to a lower dependencyrule (like the blue node).

In order to deal with cases where one algorithm maydo better than the other, we designed a heuristic thatchooses the best of the two alternatives at each itera-tion. As such, we consider a metric that chooses the bestof the two sets i.e., max(

∆Wdep

∆Cdep, ∆Wcover

∆Ccover). Then we can

apply the same greedy covering algorithm with this newmetric to choose the best set of candidate rules to cache.We refer to this version as the mixed-set algorithm.

3.5 Updating the TCAM IncrementallyAs the traffic distribution over the rules changes over

time, the set of cached rules chosen by our caching al-gorithms also change. This would mean periodicallyupdating the TCAM with a new version of the policycache. Simply deleting the old cache and inserting thenew cache from scratch is not an option because of theenormous TCAM rule insertion time. It is important tominimize the churn in the TCAM when we periodicallyupdate the cached rules.

Updating just the difference will not work.Simply taking the difference between the two sets

of cached rules—and replacing the stale rules in theTCAM with new rules (while retaining the common setof rules)—can result in incorrect policy snapshots onthe TCAM during the transition. This is mainly be-cause TCAM rule update takes time and hence packetscan be processed incorrectly by an incomplete policysnapshot during transition. For example, consider thecase where the mixed-set algorithm decides to changethe cover-set of rule R6 to its dependent set. If wesimply remove the cover rule (R∗5) and then install thedependent rules (R5,R4), there will be a time periodwhen only the rule R6 is in the TCAM without eitherits cover rules or the dependent rules. This is a policysnapshot that can incorrectly process packets while thetransition is going on.

Exploiting composition of mixed sets.A key property of the algorithms discussed so far is

that each chosen rule along with its mixed (cover or

dependent) set can be added/removed from the TCAMindependently of the rest of the rules. In other words,the mixed-sets for any two rules are easily composableand decomposable. For example, in Figure 6(b), thered rule and its cover set can be easily added/removedwithout disturbing the blue rule and its dependent set.In order to push the new cache in to the TCAM, wefirst decompose/remove the old mixed-sets (that are notcached anymore) from the TCAM and then composethe TCAM with the new mixed sets. We also maintainreference counts from various mixed sets to the ruleson TCAM so that we can track rules in overlappingmixed sets. Composing two candidate rules to build acache would simply involve merging their correspond-ing mixed-sets (and incrementing appropriate referencecounters for each rule) and decomposing would involvechecking the reference counters before removing a rulefrom the TCAM 8. In the example discussed above, ifwe want to change the cover-set of rule R6 to its de-pendent set on the TCAM, we first delete the entirecover-set rules (including rule R6) and then install theentire dependent-set of R6, in priority order.

4. CACHEMASTER DESIGNAs shown in Figure 1, CacheFlow has a CacheMaster

module that implements its control-plane logic. In thissection, we describe how CacheMaster directs “cache-miss” packets from the TCAM to the software switches,using existing switch mechanisms and preserves the se-mantics of OpenFlow.

4.1 Scalable Processing of Cache MissesCacheMaster runs the algorithms in Section 3 to com-

pute the rules to cache in the TCAM. The cache missesare sent to one of the software switches, which each storea copy of the entire policy. CacheMaster can shard thecache-miss load over the software switches.

Using the group tables in OpenFlow 1.1+, the hard-ware switch can apply a simple load-balancing policy.Thus the forward_to_SW_switch action (used in Fig-ure 4) forwards the cache-miss traffic—say, matchinga low-priority “catch-all” rule—to this load-balancinggroup table in the switch pipeline, whereupon the cache-miss traffic can be distributed over the software switches.

4.2 Preserving OpenFlow SemanticsTo work with unmodified controllers and switches,

CacheFlow preserves the semantics of the OpenFlow in-terface, including rule priorities and counters, as well asfeatures like packet_ins, barriers, and rule timeouts.Preserving inports and outports:

8The intuition is that if a rule has a positive reference count,then either its dependent-set or the cover-set is also presenton the TCAM and hence is safe to leave behind during thedecomposition phase

8

CacheMaster installs three kinds of rules in the hard-ware switch: (i) fine-grained rules that apply the cachedpart of the policy (cache-hit rules), (ii) coarse-grainedrules that forward packets to a software switch (cache-miss rules), and (iii) coarse-grained rules that handle re-turn traffic from the software switches, similar to mech-anisms used in DIFANE [23]. In addition to matchingon packet-header fields, an OpenFlow policy may matchon the inport where the packet arrives. Therefore, thehardware switch tags cache-miss packets with the in-put port (e.g., using a VLAN tag) so that the softwareswitches can apply rules that depend on the inport9.The rules in the software switches apply any “drop” or“modify” actions, tag the packets for proper forwardingat the hardware switch, and direct the packet back tothe hardware switch. Upon receiving the return packet,the hardware switch simply matches on the tag, popsthe tag, and forwards to the designated output port(s).Packet in messages: If a rule in the TCAM has an

action that sends the packet to the controller, CacheMas-ter simply forwards the the packet_in message to thecontroller. However, for rules on the software switch,CacheMaster must transform the packet_in messageby (i) copying the inport from the packet tag into theinport field of the packet_in message and (ii) strippingthe tag from the packet before sending to the controller.Traffic counts, barrier messages, and rule time-

outs: CacheFlow preserves the semantics of OpenFlowconstructs like queries on traffic statistics, barrier mes-sages, and rule timeouts by having CacheMaster emu-late these features. For example, CacheMaster main-tains packet and byte counts for each rule installed bythe controller, updating its local information each timea rule moves to a different part of the “cache hierar-chy.” Similarly, CacheMaster emulates rule timeoutsby installing rules without timeouts, and explicitly re-moving the rules when the software timeout expires.For barrier messages, CacheMaster first sends a bar-rier request to all the switches, and waits for all ofthem to respond before sending a barrier reply to thecontroller. In the meantime, CacheMaster buffers allmessages from the controller before distributing themamong the switches.

5. COMMODITY SWITCH AS THE CACHEThe hardware switch used as a cache in our system

is a Pronto-Pica8 3290 switch running PicOS 2.1.3 sup-9Tagging the cache-miss packets with the inport can leadto extra rules in the hardware switch. In several practicalsettings, the extra rules are not necessary. For example, ina switch used only for layer-3 processing, the destinationMAC address uniquely identifies the input port, obviatingthe need for a separate tag. Newer version of OpenFlowsupport switches with multiple stages of tables, allowing usto use one table to push the tag and another to apply the(cached) policy.

0

20

40

60

80

100

0 400 800 1200 1600 2000

Avg

run

ning

tim

e (s

ec)

Number of rules inserted

TCAM update time

Figure 7: TCAM Update Time

porting OpenFlow. We uncovered several limitations ofthe switch that we had to address in our experiments:Incorrect handling of large rule tables: The

switch has an ASIC that can hold 2000 OpenFlow rules.If more than 2000 rules are sent to the switch, 2000 ofthe rules are installed in the TCAM and the rest in thesoftware agent. However, the switch does not respectthe cross-rule dependencies when updating the TCAM,leading to incorrect forwarding behavior! Since we can-not modify the (proprietary) software agent, we simplyavoid triggering this bug by assuming the rule capacityis limited to 2000 rules. Interestingly, the techniquespresented in this paper are exactly what the softwareagent should use to fix this bug!Slow processing of control commands: The switch

is slow at updating the TCAM and querying the trafficcounters. The time required to update the TCAM is anon-linear function of the number of rules being addedor deleted, as shown in Figure 7. While the first 500rules take 6 seconds to add, the next 1500 rules takesalmost 2 minutes to install. During this time, queryingthe switch counters easily led to the switch CPU hitting100% utilization and, subsequently, to the switch dis-connecting from the controller. In order to get aroundthis, we wait till the set of installed rules is relativelystable to start querying the counters at regular inter-vals and rely on counters in the software switch in themeantime.

6. PROTOTYPE AND EVALUATIONWe implemented a prototype of CacheFlow in Python

using the Ryu controller library so that it speaks Open-Flow to the switches. On the north side, CacheFlowprovides an interface which control applications can useto send FlowMods to CacheFlow, which then distributesthem to the switches. At the moment, our prototypesupports the semantics of the OpenFlow 1.0 featuresmentioned earlier (except for rule timeouts) transpar-ently to both the control applications and the switches.

We use the Pica8 switch as the hardware cache, con-nected to an Open vSwitch 2.1.2 multithread softwareswitch running on an AMD 8-core machine with 6GBRAM. To generate data traffic, we connected two hostmachines to the Pica8 switch and use tcpreplay to sendpackets from one host to the other.

9

0

20

40

60

80

100

0.5 1 2 5 10 25 50

% C

ache

-hit

traf

fic

% TCAM Cache Size (Log scale)

Mixed-Set AlgoCover-Set Algo

Dependent-Set Algo

(a) REANNZ IXP switch

0

20

40

60

80

100

63 125 250 500 1000 2000

% C

ache

-hit

traf

fic

TCAM Cache Size (Log scale)

Mixed-Set AlgoCover-Set Algo

Dependent-Set Algo

(b) Stanford backbone router

0

20

40

60

80

100

63 125 250 500 1000 2000

% C

ache

-hit

traf

fic

TCAM Cache Size (Log scale)

Mixed-Set AlgoCover-Set Algo

Dependent-Set Algo

(c) CAIDA packet trace

Figure 8: Cache-hit rate vs. TCAM size for three algorithms and three policies (with x-axis on log scale)

6.1 Cache-hit RateWe evaluate our prototype against three policies and

their corresponding packet traces: (i) A publicly avail-able packet trace from a real data center and a syntheticpolicy, (ii) An educational campus network routing pol-icy and a synthetic packet trace, and (iii) a real Open-Flow policy and the corresponding packet trace from anInternet eXchange Point (IXP). We measure the cache-hit rate achieved on these policies using three cachingalgorithms (dependent-set, cover-set, and mixed-set).The cache misses are measured by using ifconfig onthe software switch port and then the cache hits are cal-culated by subtracting the cache misses from the totalpackets sent as reported by tcpreplay. All the resultsreported here are made by running the Python codeusing PyPy to make the code run faster.REANNZ. Figure 8(a) shows results for an SDN-

enabled IXP that supports the REANNZ research andeducation network [19]. This real-world policy has 460OpenFlow 1.0 rules matching on multiple packet head-ers like inport, dst_ip, eth_type, src_mac, etc. Mostdependency chains have depth 1 (some light-hitting ruleshave complex dependencies as shown in Figure 3(b)).We replayed a two-day traffic trace from the IXP, andupdated the cache every two minutes and measured thecache-hit rate over the two-day period. Because of themany shallow dependencies, all three algorithms havethe same performance. The mixed-set algorithm sees acache hit rate of 84% with a hardware cache of just 2%of the rules; with just 10% of the rules, the cache hitrate increases to as much as 97%.Stanford Backbone. Figure 8(b) shows results for

a real-world Cisco router configuration on a Stanfordbackbone router [24]. which we transformed into anOpenFlow policy. The policy has 180K OpenFlow 1.0rules that match on the destination IP address, withdependency chains varying in depth from 1 to 8. Wegenerated a packet trace matching the routing policyby assigning traffic volume to each rule drawn from aZipf [11] distribution. The resulting packet trace hadaround 30 million packets randomly shuffled over 15minutes. The mixed-set algorithm does the best amongall three and dependent-set does the worst because there

0

0.2

0.4

0.6

0.8

1

1.2

1-Way Hit 2-Way Miss

Late

ncy

in m

s

Cache Miss Latency Overhead

Figure 9: Cache-Miss Latency Overhead

is a mixture of shallow and deep dependencies. Whilethere are differences in the cache-hit rate, all three algo-rithms achieve at least 88% hit rate at the total capacityof 2000 rules (which is just 1.1% of the total rule table).Note that CacheFlow was able to react effectively tochanges in the traffic distribution for such a large num-ber of rules (180K in total) and the software switch wasalso able to process all the cache misses at line rate.Note that installing the same number of rules in theTCAM of a hardware switch, assuming that TCAMsare 80 times more expensive than DRAMs, requires oneto spend 14 times more money on the memory unit.CAIDA. The third experiment was done using the

publicly available CAIDA packet trace taken from theEquinix datacenter in Chicago [25]. The packet tracehad a total of 610 million packets sent over 30 minutes.Since CAIDA does not publish the policy used to pro-cess these packets, we built a policy by extracting for-warding rules based on the destination IP addresses ofthe packets in the trace. We obtained around 14000 /20IP destination based forwarding rules. This was thensequentially composed [18] with an access-control policythat matches on fields other than just the destinationIP address. The ACL was a chain of 5 rules that matchon the source IP, the destination TCP port and inportof the packets which introduce a dependency chain ofdepth 5 for each destination IP prefix. This compositionresulted in a total of 70K OpenFlow rules that matchon multiple header fields. This experiment is meant toshow the dependencies that arise from matching on var-ious fields of a packet and also the explosion of depen-dencies that may arise out of more sophisticated poli-cies. Figure 8(c) shows the cache-hit percentage undervarious TCAM rule capacity restrictions. The mixed-

10

0 2 4 6 8

10 12 14 16 18

10 100 200 500 1000

Avg

. run

ning

tim

e(se

c)

Number of rules inserted

Incremental InsertIncremental Delete

(a) Incremental DAG update

0

20

40

60

80

100

63 125 250 500 1000 2000

% C

ache

-hit

traf

fic

TCAM Cache Size (Log scale)

Nuclear UpdateIncremental Update

(b) Incremental/nuclear cache-hit rate

0

20

40

60

80

100

0 500 1000 1500

% C

ache

-hits

per

sec

ond

Time in seconds

Nuclear UpdateIncremental Update

(c) Incremental vs. nuclear stability

Figure 10: Performance of Incremental Algorithms for DAG and TCAM update

set and cover-set algorithms have similar cache-hit ratesand do much better than the dependent-set algorithmconsistently because they splice every single dependencychain in the policy. For any given TCAM size, mixed-set seems to have at least 9% lead on the cache-hit rate.While mixed-set and cover-set have a hit rate of around94% at the full capacity of 2000 rules (which is just 3%of the total rule table), all three algorithms achieve atleast an 85% cache-hit rate.Latency overhead. Figure 9 shows the latency in-

curred on a cache-hit versus a cache-miss. The latencywas measured by attaching two extra hosts to the switchwhile the previously CAIDA packet trace was being run.Extra rules initialized with heavy volume were addedto the policy to process the ping packets in the TCAM.The average round-trip latency when the ping packetswere cache-hits in both directions was 0.71ms while thelatency for 1-way cache miss was 0.81ms. Thus, thecost of a 1-way cache miss was 100µs; for comparison, ahardware switch adds 25µs [26] to the 1-way latency ofthe packets. If an application cannot accept the addi-tional cost of going to the software switch, it can requestthe CacheMaster to install its rules in the fast path. ThecacheMaster can do this by assigning “infinite" weightto these rules.

6.2 Incremental AlgorithmsIn order to measure the effectiveness of the incremen-

tal update algorithms, we conducted two experimentsdesigned to evaluate (i) the algorithms to incrementallyupdate the dependency graph on insertion or deletionof rules and (ii) algorithms to incrementally update theTCAM when traffic distribution shifts over time.

Figure 10(a) shows the time taken to insert/deleterules incrementally on top of the Stanford routing policyof 180K rules. While an incremental insert takes about15 milliseconds on average to update the dependencygraph, an incremental delete takes around 3.7 millisec-onds on average. As the linear graphs show, at least forabout a few thousand inserts and deletes, the amountof time taken is strictly proportional to the number offlowmods. Also, an incremental delete is about 4 timesfaster on average owing to the very local set of depen-

dency changes that occur on deletion of a rule while aninsert has to explore a lot more branches starting withthe root to find the correct position to insert the rule.We also measured the time taken to statically build thegraph on a rule insertion which took around 16 minutesfor 180K rules. Thus, the incremental versions for up-dating the dependency graph are ∼60000 times fasterthan the static version.

In order to measure the advantage of using the in-cremental TCAM update algorithms, we measured thecache-hit rate for mixed-set algorithm using the two op-tions for updating the TCAM. Figure 10(b) shows thatthe cache-hit rate for the incremental algorithm is sub-stantially higher as the TCAM size grows towards 2000rules. For 2000 rules in the TCAM, while the incre-mental update achieves 93% cache-hit rate, the nuclearupdate achieves only 53% cache-hit rate. As expected,the nuclear update mechanism sees diminishing returnsbeyond 1000 rules because of the high rule installationtime required to install more than 1000 rules as shownearlier in Figure 7.

Figure 10(c) shows how the cache-hit rate is affectedby the naive version of doing a nuclear update on theTCAMwhenever CacheFlow decides to update the cache.The figure shows the number of cache misses seen overtime when the CAIDA packet trace is replayed at 330kpackets per second. The incremental update algorithmstabilizes quite quickly and achieves a cache-hit rate of95% in about 3 minutes. However, the nuclear updateversion that deletes all the old rules and inserts the newcache periodically suffers a lot of cache-misses while itis updating the TCAM. While the cache-hits go up to90% once the new cache is fully installed, the hit rategoes down to near 0% every time the rules are deletedand it takes around 2 minutes to get back to the highcache-hit rate. This instability in the cache-miss ratemakes the nuclear installation a bad option for updat-ing the TCAM.

7. RELATED WORKWhile route caching is discussed widely in the context

of IP destination prefix forwarding, SDN introduces newconstraints on rule caching. We divide the route caching

11

literature into three wide areas: (i) IP route Caching (ii)TCAM optimization, and (iii) SDN rule caching.IP Route Caching. Earlier work on traditional

IP route caching [11–14, 27] talks about storing only asmall number of IP prefixes in the switch line cards andstoring the rest in inexpensive slow memory. Most ofthem exploit the fact that IP traffic exhibits both tem-poral and spatial locality to implement route caching.For example, Sarrar et.al [11] show that packets hittingIP routes collected at an ISP follow a Zipf distribu-tion resulting in effective caching of small number ofheavy hitter routes. However, most of them do not dealwith cross-rule dependencies and none of them deal withcomplex multidimensional packet-classification. For ex-ample, Liu et.al [27] talk about efficient FIB cachingwhile handling the problem of cache-hiding for IP pre-fixes. However, their solution cannot handle multipleheader fields or wildcards and does not have the notionof packet counters associated with rules. Our paper, onthe other hand, deals with the analogue of the cache-hiding problem for more general and complex packet-classification patterns and also preserves packet coun-ters associated with these rules.TCAMRule Optimization. The TCAMRazor [28–

30] line of work compresses multi-dimensional packet-classification rules to minimal TCAM rules using deci-sion trees and multi-dimensional topological transfor-mation. Dong et. al. [31] propose a caching techniquefor ternary rules by constructing compressed rules forevolving flows. Their solution requires special hardwareand does not preserve counters. In general, these tech-niques that use compression to reduce TCAM space alsosuffer from not being able to make incremental changesquickly to their data-structures.DAG for TCAM Rule Updates. The idea of us-

ing DAGs for representing TCAM rule dependencies isdiscussed in the literature in the context of efficientTCAM rule updates [32, 33]. In particular, their aimwas to optimize the time taken to install a TCAM ruleby minimizing the number of existing entries that needto be reshuffled to make way for a new rule. They do soby building a DAG that captures how different rules areplaced in different TCAM banks for reducing the updatechurn. However, the resulting DAG is not suitable forcaching purposes as it is difficult to answer the ques-tion we ask – if a rule is to be cached, which other rulesshould go along with it? In addition, the DAG datastructure is either limited by supporting only wild-cardrules [33] or it is optimized for the physical layout ofthe TCAM [32].SDN Rule Caching. There is some recent work

on dealing with limited switch rule space in the SDNcommunity. DIFANE [23] advocates caching of ternaryrules, but uses more TCAM to handle cache misses—leading to a TCAM-hungry solution. Other work [34–

36] shows how to distribute rules over multiple switchesalong a path, but cannot handle rule sets larger thanthe aggregate table size. Devoflow [37] introduces theidea of rule “cloning” to reduce the volume of trafficprocessed by the TCAM, by having each match in theTCAM trigger the creation of an exact-match rules (inSRAM) the handle the remaining packets of that mi-croflow. However, Devoflow does not address the limi-tations on the total size of the TCAM. Lu et.al. [38] usethe switch CPU as a traffic co-processing unit wherethe ASIC is used as a cache but they only handle mi-croflow rules and hence do not handle complex depen-dencies. The Open vSwitch [10] caches “megaflows” (de-rived from wildcard rules) to avoid the slow lookup timein the user space classifier. However, their techniquedoes not assume high-throughput wildcard lookup inthe fast path and hence cannot be used directly for op-timal caching in TCAMs.

8. CONCLUSIONIn this paper, we define a hardware-software hybrid

switch design called CacheFlow that relies on rule cachingto provide large rule tables at low cost. Unlike tra-ditional caching solutions, we neither cache individualrules (to respect rule dependencies) nor compress rules(to preserve the per-rule traffic counts). Instead we“splice” long dependency chains to cache smaller groupsof rules while preserving the semantics of the networkpolicy. Our design satisfies four core criteria: (1) elas-ticity (combining the best of hardware and softwareswitches), (2) transparency (faithfully supporting na-tive OpenFlow semantics, including traffic counters),(3) fine-grained rule caching (placing popular rules inthe TCAM, despite dependencies on less-popular rules),and (4) adaptability (to enable incremental changes tothe rule caching as the policy changes).

9. REFERENCES[1] “TCAMs and OpenFlow: What every SDN practitioner

must know.” See http://tinyurl.com/kjy99uw, 2012.[2] B. Stephens, A. Cox, W. Felter, C. Dixon, and J. Carter,

“PAST: Scalable Ethernet for data centers,” in ACMSIGCOMM CoNext, 2012.

[3] “SDN system performance.” See http://www.pica8.com/pica8-deep-dive/sdn-system-performance/, 2012.

[4] E. Spitznagel, D. Taylor, and J. Turner, “Packetclassification using extended TCAMs,” in ICNP 2003.

[5] X. Jin, H. H. Liu, R. Gandhi, S. Kandula, R. Mahajan,M. Zhang, J. Rexford, and R. Wattenhofer, “Dynamicscheduling of network updates,” in SIGCOMM, 2014.

[6] D. Y. Huang, K. Yocum, and A. C. Snoeren, “High-fidelityswitch models for software-defined network emulation,” inHotSDN, Aug. 2013.

[7] M. Dobrescu, N. Egi, K. Argyraki, B.-G. Chun, K. Fall,G. Iannaccone, A. Knies, M. Manesh, and S. Ratnasamy,“RouteBricks: Exploiting parallelism to scale softwarerouters,” in SOSP, 2009.

[8] S. Han, K. Jang, K. Park, and S. Moon, “PacketShader: AGPU-accelerated software router,” in SIGCOMM 2010.

[9] “Intel DPDK overview.” See http://tinyurl.com/cepawzo.

12

[10] B. Pfaff, J. Pettit, T. Koponen, E. Jackson, A. Zhou,J. Rajahalme, J. Gross, A. Wang, J. Stringer, P. Shelar,K. Amidon, and M. Casado, “The design andimplementation of Open vSwitch,” in NSDI, 2015.

[11] N. Sarrar, S. Uhlig, A. Feldmann, R. Sherwood, andX. Huang, “Leveraging Zipf’s law for traffic offloading,”SIGCOMM Comput. Commun. Rev. 2012.

[12] C. Kim, M. Caesar, A. Gerber, and J. Rexford, “Revisitingroute caching: The world should be flat,” in Passive andActive Measurement, 2009.

[13] D. Feldmeier, “Improving gateway performance with arouting-table cache,” in IEEE INFOCOM, 1988.

[14] H. Liu, “Routing prefix caching in network processordesign,” in ICCN 2001, 2001.

[15] N. Foster, R. Harrison, M. J. Freedman, C. Monsanto,J. Rexford, A. Story, and D. Walker, “Frenetic: A networkprogramming language,” in Proceedings of ICFP ’11.

[16] X. Jin, J. Gossels, J. Rexford, and D. Walker, “Covisor: Acompositional hypervisor for software-defined networks,” inNSDI, 2015.

[17] N. Katta, O. Alipourfard, J. Rexford, and D. Walker,“Infinite Cacheflow in software-defined networks,” inHotSDN Workshop, 2014.

[18] C. Monsanto, J. Reich, N. Foster, J. Rexford, andD. Walker, “Composing software defined networks,” inNSDI, 2013.

[19] “REANZZ.” http://reannz.co.nz/.[20] P. Bosshart, G. Gibb, H.-S. Kim, G. Varghese,

N. McKeown, M. Izzard, F. Mujica, and M. Horowitz,“Forwarding metamorphosis: Fast programmablematch-action processing in hardware for SDN,” in ACMSIGCOMM, 2013.

[21] P. Kazemian, G. Varghese, and N. McKeown, “Header spaceanalysis: Static checking for networks,” in NSDI, 2012.

[22] S. Khuller, A. Moss, and J. S. Naor, “The budgetedmaximum coverage problem,” Inf. Process. Lett., Apr. 1999.

[23] M. Yu, J. Rexford, M. J. Freedman, and J. Wang, “Scalableflow-based networking with DIFANE,” in ACMSIGCOMM, 2010.

[24] “Stanford backbone router forwarding configuration.”http://tinyurl.com/oaezlha.

[25] “The CAIDA anonymized Internet traces 2014 dataset.”http://www.caida.org/data/passive/passive_2014_dataset.xml.

[26] R. Mittal, N. Dukkipati, E. Blem, H. Wassel, M. Ghobadi,A. Vahdat, Y. Wang, D. Wetherall, D. Zats, et al., “Timely:Rtt-based congestion control for the datacenter,” inProceedings of the 2015 ACM Conference on SpecialInterest Group on Data Communication, pp. 537–550,ACM, 2015.

[27] Y. Liu, S. O. Amin, and L. Wang, “Efficient FIB cachingusing minimal non-overlapping prefixes,” SIGCOMMComput. Commun. Rev., Jan. 2013.

[28] A. X. Liu, C. R. Meiners, and E. Torng, “TCAM Razor: Asystematic approach towards minimizing packet classifiersin TCAMs,” IEEE/ACM Trans. Netw, Apr. 2010.

[29] C. R. Meiners, A. X. Liu, and E. Torng, “Topologicaltransformation approaches to tcam-based packetclassification,” IEEE/ACM Trans. Netw., vol. 19, Feb.2011.

[30] C. R. Meiners, A. X. Liu, and E. Torng, “Bit weaving: Anon-prefix approach to compressing packet classifiers inTCAMs,” IEEE/ACM Trans. Netw., vol. 20, Apr. 2012.

[31] Q. Dong, S. Banerjee, J. Wang, and D. Agrawal, “Wirespeed packet classification without TCAMs: A few moreregisters (and a bit of logic) are enough,” in ACMSIGMETRICS, 2007.

[32] B. Vamanan and T. N. Vijaykumar, “Treecam: Decouplingupdates and lookups in packet classification,” inProceedings of the Seventh COnference on EmergingNetworking EXperiments and Technologies, CoNEXT ’11,(New York, NY, USA), pp. 27:1–27:12, ACM, 2011.

[33] H. Song and J. Turner, “Nxg05-2: Fast filter updates forpacket classification using tcam,” in GlobalTelecommunications Conference, 2006. GLOBECOM’06.IEEE, pp. 1–5, IEEE, 2006.

[34] Y. Kanizo, D. Hay, and I. Keslassy, “Palette: Distributingtables in software-defined networks,” in IEEE INFOCOMMini-conference, Apr. 2013.

[35] M. Moshref, M. Yu, A. Sharma, and R. Govindan,“Scalable rule management for data centers,” in NSDI 2013.

[36] N. Kang, Z. Liu, J. Rexford, and D. Walker, “Optimizingthe ’one big switch’ abstraction in Software DefinedNetworks,” in ACM SIGCOMM CoNext, Dec. 2013.

[37] A. R. Curtis, J. C. Mogul, J. Tourrilhes, P. Yalagandula,P. Sharma, and S. Banerjee, “DevoFlow: Scaling flowmanagement for high-performance networks,” in ACMSIGCOMM, 2011.

[38] G. Lu, R. Miao, Y. Xiong, and C. Guo, “Using CPU as atraffic co-processing unit in commodity switches,” inHotSDN Workshop, 2012.

13