What	  can	  SDN	  do	  for	  IoT?		  
Kotaro	  Kataoka	  (kotaro@iith.ac.in)	  Indian	  Ins:tute	  of	  Technology	  Hyderabad	  IoT	  over	  Enterprise	  Network	• Connec:ng	  Sensors	  to	  Campus	  LAN	  or	  Wi-­‐Fi	  – Alterna:ve	  connec:vity	  in	  addi:on	  to	  Bluetooth,	  ZigBee,	  PLC	  and	  etc.	  
– Quality	  of	  IoT	  will	  be	  manageable	  • Challenges	  – Scalability:	  Large	  number	  of	  devices	  – QoS:	  Coexistence	  with	  commodity	  traﬃc	  – Mobility:	  Smartphone	  works	  as	  IoT	  device	  – Security:	  Heterogeneity	  of	  supported	  mode	  of	  authen:ca:on	  – Mission	  Cri:cal	  Data:	  No	  mistake	  in	  commanding	  system	  – etc	  A	  Big	  Setup	  as	  Target	  Field	
• Permanent	  Campus	  of	  IIT	  Hyderabad	  – Academic	  Buildings	  – Hostel	  Buildings	  Indian Institute of Technology Hyderabad
Layer 1 Network Topology
As of February 6th 2014

RouterODF

L3
SwitchFirewall

L2
SwitchSDN

10G OFC LAN Connection

Internet Connection

1G OFC LAN Connection

Current	  SDN	  Deployment	  in	  IIT	  Hyderabad	
Metal LAN Connection(with OFC - Metal Media Converter)Inter-Campus Connection

Metal LAN Connection

BSNL

NKN

Gi0/0

BSNL
DMZ

SDN	  switches	  are	  deployed	  at	  core	  and	  edges	  of	  the	  campus	  network	  •C1

L Cisco 2921

Gi0/CN

1

ASR

Gi0/1

GE 1

Gi0/2

– Overlaying	  SDN	  switches	  on	  tradi:onal	  LAN	  Service

Gi0/

Gi0/1

8

Gi0/1

C7

Gi0/2

IITH	  network	  is	  ready	  for	  tes:ng	  developed	  codes	  Hardware:	  HP	  3800-­‐24G-­‐Poe+-­‐2SFP+,	  HP	  5400zl	  with	  8	  x	  10Gbe	  Ports	  ••Eth0/0

OLD
ASA

Gi0/4

NKN
DMZ

Gi0/7

Cx1

TBD

Gi0/8

A1Gi0/0A2/7Gi0,MGi0/1

C5t/20Gi0/24/1
Te1

6/1C3

Te1/1
Gi0/23/0/2

SDN/2/0Te1

ISE

eth0

Ge1/0/14

Te1/0/2

Te1/1

    

SDN! 

!



C8

Gi1/0/1

Gi1/0/47, Gi1/0/48
4/2
Gi0

Po1

Gi1/0/23

Director's
OfficeTe
10/2 /15

3/2
Gi0

Te1/Te1/0/1

 





Gi0/1

C2

Gi0

Gi0/21
Gi0/24Gi0

Gi1/3

Te1/0/1/1
Gi0Te
1CW3
Faculty Gi1/0/25
Cabin

Director'sHome

Gi0/20

Gi0/2

Gi0/10WLC
Primary

Gi0/1

Gi0/24
Gi0/23

Gi0/3,
Gi0/4,
Gi0/12C6

Gi0/3

Gi0/1,Gi0/6

Gi0/14

Gi0/15

Cx3/1
Gi0

g0/0

Gi0/1

C5

Gi0/5

Gi0/0

Gi0/3

Cx2

DISANET

Gi1/0/47, Gi1/0/48

CW1
GF-Conf
TBD

Gi0/23C9



Gi1/0/23

WLC
Secondary

Po1

CW2
GF-LH1Gi1/0/24
CW7
HostelOffice Gi1/0/22
400S Gi1/0/23
Gi1/0/26
Gi1/0/25

Gi0/9
Gi0/10

TBD

Po1 ?

   ! 

C4

Po1 ?

Te1/0/1 

Gi0/10Gi1/0/46

Te1/0/1

L Cat3560X-24T-E

Last PortLAST Port

Gi1/0/24

Gi1/0/27

SG-300Gi1/0/28

Gi1/0/25
SDN

Gi1/0/45

CW4
Girls
Hostel10/100OLD
Wi-Fi?
Switch?

CW8500S

CW11CHEM Gi1/0/25
Lab
Gi1/0/26

Gi1/0/25



Gi1/0/26

CW12600S

Gi1/0/16

Gi1/0/25

CW5100S

CW10900S

Gi1/0/24
E1
Gi1/0/24
CW6300S

SDN

Gi1/0/24
Gi1/0/23
CW900S



Some	  SDN	  Works	  in	  IIT	  Hyderabad	• Scaling	  Ethernet	  Broadcast	  Domain	  • Freedom	  of	  Authen:ca:on	  Mode	  and	  Per-­‐device	  Access	  Control	  • Applica:on-­‐aware	  Mul:path	  Packet	  Forwarding	Scaling	  Ethernet	  Broadcast	  Domain	  (1/2)	
Large-­‐scale	  LAN	  – Wired:	  Full	  Duplex,	  Wireless:	  Half	  Duplex	  Broadcast	  messages	  from	  many	  hosts	  will	  make	  LAN	  busy	  – Performance	  restric:on	  – Unwanted	  broadcast	  traﬃc	  to	  Wireless	  network	  Small	  LAN	  for	  Wireless	  Networks?	  
– Routers	  and	  switches	  will	  be	  busy	  due	  to	  too	  may	  subnets	  and	  VLANs	  – U:liza:on	  of	  address	  space	  will	  be	  less	  Solu:on:	  Filter	  and	  Isolate	  the	  broadcast	  messages!!	

•••• AFTER	BEFORE	   

            

           





















Scaling	  Ethernet	  Broadcast	  Domain	  (2/2)	
• Extensible	  Transparent	  Filter	  (ETF)	  mac_db'– MAC-­‐based	  approach	  – Detect	  device	  – Learn	  loca:on	  – Forward	  broadcast	  message	  like	  Unicast	

dhcp_db'

DHCP''
Module'ARP''
Module'packet_in'
handler'           (Other'Protocols)'

Flow'Rule,'Packet'Out'
Incoming'Packet'
DB'Access'   other_db'

SDN'Controller'

AFTER	

BEFORE	

arp_db'host_db'             



SAFE	  (1/2)	
• Soeware-­‐deﬁned	  Authen:ca:on	  Framework	  	  – Device-­‐level	  isola:on	  in	  SDN	  – Separa:ng	  Authen'ca'on	  and	  Access	  Control	  – More	  freedom	  on	  mode	  of	  authen:ca:on	  – Suppor:ng	  non-­‐SDN	  switches	  Control%Plane%%
Data%Plane%%
SAFE%%%%%%%%%%%%%%

Database%
Server%SAFE%
Controller%

Authen/ca/on%
Server%	
Network%
Resources

SDN%
Switch%Host

Non<SDN%
Switch%

Host

Host

Host

SAFE	  (2/2)	
• Any	  mode	  of	  authen:ca:on	  can	  be	  used	  only	  if	  it	  can	  trigger	  SAFE	  server	  (has	  DB	  to	  maintain	  authen:cated	  hosts	  and	  loca:on)		  • What	  is	  an	  interes:ng	  mode	  of	  authen:ca:on?	  
– IoT:	  Reading	  MAC	  address	  using	  RFID,	  QR	  Code	  and	  Photograph	– Smartphone:	  Rich	  informa:on	  (user	  proﬁle)	
– Inter-­‐campus	  roaming	  by	  shared	  database	QoS	  using	  Machine	  Learning	  and	  Mul:path	  Packet	  Forwarding	  (1/2)	
•Awareness	  of	  Applica:ons	  – Fundamental	  part	  for	  QoS	  – Machine	  Learning	  can	  go	  beyond	  the	  tradi:onal	  mode	  (Proto/Port#)	  •Why	  QoS	  +	  Mul:path	  Packet	  Forwarding?	  

– Priori:ze	  the	  traﬃc	  – Achieve	  high	  u:liza:on	  of	  network	  in	  more	  aggressive	  manner	  •Solu:on	  – Automa:cally	  classify	  the	  input	  traﬃcs	  and	  apply	  QoS	  policy	  to	  each	  of	  them	  – Let	  each	  of	  traﬃc	  travel	  diﬀerent	  paths	  QoS	  using	  Machine	  Learning	  and	  Mul:path	  Packet	  Forwarding	  (2/2)	
Fig. 3.

Experiment Setup Topologyof the switches was fixed at 32 MBps and the link between
the hosts and the switches were assigned 1 Gbps. This set up
was evaluated on four flows namely class C1, C2, C3 and C4.
Following are the properties :• Machine	  Learning	  for	  Applica:on	  Awareness	  – SVM	  (Support	  Vector	  Machine)	  looks	  the	  best	  TABLE II.

• Finding	  mul:ple	  paths	  E NTERPRISE S CENARIO T ESTBED F LOW
C HARACTERISTICS

Class
Min. B/W
Max. B/W
Jitter Tolerance
Delay Tolerance– Yen's	  K	  shortest	  path	  
C1
16M
N/A
Low
Low
C2
16M
N/AMidMid– Find	  the	  best	  path,	  then	   C3 4M
16MMidMid
C4N/A8MMidMidproceeds	  to	  ﬁnd	  K	  −	  1	  devia:ons	  The second of the evaluation setups was the internet– Metrics:	  Delay	  +	  BW	   scenario. The setup in itself was identical to the one used forthe enterprise scenario, but the link between the switched had
a X Gbps link and the links between the switches and the hosts
were of Y Mbps capacity. Again similar to the previous setup
the network was evaluated over four flows classes, namely
C1 (Realtime Traffic), C2 (Buffered/file transfer), C3 (WebBrowsing) and C4 (Restricted/File Transfers). Following are
the characteristics of the flows :TABLE III.
ClassC1C2C3C4I NTERNET S CENARIO T ESTBED F LOW C HARACTERISTICS
Min. B/W
400M
200M
100M
N/A

Max. B/W
N/A
400M
200M
100M

Jitter Tolerance
Low
Mid
Mid
Mid

Delay Tolerance
Low
Mid
Mid
Mid

ness:
out thrando
least2)ness:
flow
priorisecon
make
two oSince
from
avoid
which
packe
for 1
found
is upd

C. AW
train
Dropb
Maps
The fltraine

Integra:ng	  “Things”	  to	  SDN	  Testbed	  in	  IIT	  Hyderabad	• Tes:ng	  SDN	  protocols	  for	  wireless	  devices	  	– OpenFlow-­‐capable	  Wi-­‐Fi	  in	  IIT	  Hyderabad	  – Coexistence	  of	  commodity	  traﬃc	  and	  “Things’	  data”	  • Open	  Network	  Testbed	  – IIT	  Hyderabad	  welcomes	  sensors	  and	  networks	  to	  be	  deployed	  Other	  On-­‐going	  Works	
• Distributed	  NFV	  – Cloud,	  SDN	  and	  Awareness	  • Packet	  Tagging:	  Service-­‐oriented	  Packet	  Forwarding	  in	  SDN	  – Rou:ng	  in	  • Wireless	  Mobility	  in	  SDN	  – Smaller	  broadcast	  domain,	  loca:on-­‐speciﬁc	  rou:ng,	  seamless	  connec:vity	  • QoS-­‐aware	  Mul:cast	  in	  SDN	  • Speeding-­‐up	  ICN	  in	  SDN	  (Making	  change	  in	  OpenFlow)	  • How	  bumpy	  are	  Indian	  roads?	  
• Real-­‐:me	  Online	  Counseling	  for	  Mental	  Health	  Care	  (To	  be	  funded	  by	  GoI)	  THANK	  YOU	  AND	  Q&A	

Backup	  Slides	

Bumpiness	  in	  HYD	liteFlow	  (1/2)	
• A	  lightweight	  and	  distributed	  ﬂow	  monitoring	  system	  for	  SDN	  – Flow-­‐based	  monitoring	  with	  accuracy	  of	  packet	  capturing	  – Less	  and	  distributed	  resource	  consump:on	  SDN	  at	  switches	  on	  end-­‐to-­‐end	  path	  of	  a	  ﬂow	  • Resource	  awareness	  (TCAM	  usage)	  • Selec:on	  of	  Authority	  Switch	  in	  charge	  of	  monitoring	  a	  ﬂow	  • Other	  switches	  simply	  forward	  packets	  on	  a	  ﬂow	  liteFlow&+&SDN&Controller?	

?	

S1&

S3

S2

S4

S5

S6&?	
H1

H2	

H20

H21

H22

!"!

!#!

$%!

!#9!

!#"!

!##!

Figure 6: Mininet Topology for Evaluationts >VI. E VALUATION
A. Performance of F lowP artitionerueandnstallation
the below

counts theparticularermine IPe metrics

Using mininet [17], we tested F lowP artitioner on
the topology shown in Figure 6. For traffic generation, we have
set up •IperfScenarios	  [18] servers on H21 and H22 attached to switch
S6. All the hosts
connected toS1 act as(Iperf– Monitor	  at	  switch
all	  switches	  F	  *	  Nclients	  ﬂow	  rules	  per	  host)	  to the two Iperf servers.
– Ingress	  switch	  scenario	  (F	  +	  N	  –	  1	  ﬂow	  rules	  per	  host)	  Our evaluations will compare the Approach 2 and– defined
liteFlow	  scenario	  (F	  +paper.	  N	  -­‐1	  Figures
ﬂow	  rules	  with	  load	  balancing)	  Approach 3 asin Section
3 of this
7and 8 •are theresult plot of number of flows installed on theLiteFlow	  switches and time duration for which the evaluations are done.
– theAuthority	  Switch:	  the5-­‐tuple	  srcIP,	  Figure 7 shows
results of installing
5-tuple (flowrulesdstIP,	  srcPort,	  dstPort,	  protocol)	  – Other	  Switches:	  2-­‐touple	  (srcIP,	  dst	  IP)	  300

300

S1
S2
S3
S4S5S6250

200

150100switch ancontroller

S1S2
S3S4S5S6250

No. Of FlowRules

andNo. Of FlowRules

lseliteFlow	  (2/2)	

MOCRNSD
O200150100

TABL
505000200

400600800
1000Time (sec)

1200

1400

1600

Figure 7: Number of Flow Rules in Ingress Switch Approach

SwFi

00200

400

600

800
1000
Time (sec)

1200

1400

1600

TABL

Figure 8: Number of Flow Rules in liteF low Approach
600

Wi-­‐Pi	  (1/2)	
Table 1: Implementation Setup Detail
Hardware Specifications
Software Requirements
OS: Raspbian OS (version: July 2014)
Wi-Fi dongle and compatible drivers SSH, SSHPASS, SCREEN and SCP packages
8GB Memory Card
Python 2.7
OS: Ubuntu 12.04.4 LTS
2GB of RAM
Apache Server
10GB of memory space
Python 2.7
No. of CPUs: Minimum 1
MySQL connector module for python
Architecture : x86 64
SSH, SCREEN, SCP packages
1:
Network Connection for coneectivity Crontab: to automate the job of backing up the database• Distributed	  Wi-­‐Fi	  Performance	  Assessment	  using	  Raspberry	  Pi	  Device– Data	  form	  user’s	  perspec:ve	  Pi– Cheap,	  Distributed,	  Always	  up,	  DTN	  – No	  need	  of	  moving	  around	  quality	  +	  Pinger	  alized as –perWi-­‐Fi	  the frequency
band.(RTT/PacketLoss)	  Also real-time charts
Serverare generated
using
the data
received by Hthe– Visualiza:on	  &	  Management:	  eat	  server.
mapper	  +	  UI	  3.5 Setting up Wi-Pi
This system is already implemented and running in
IIT Hyderabad on a low scale, Table 1 describes thehardware and software specifications used for implementation by Pi and server. Other than the mentioned
specifications server also uses Google Maps API for plotting the heat map on geographical map, and HighCharts
for analyzing the packet loss, latency and signal strength
data by making the charts.
For setting up a Pi, memory card image[1] can be directly used. If we need to start with scratch by installing
Raspbian OS on Pi and pull the code from GitHub[1]then we can follow the steps mentioned in manual. Registration of Pi can be done easily from Web UI, where as
registrations of access point is automatic. But registration of access point is not completed until user specifies
location of any one of the interface of access point, otherinterfaces will be automatically registered. Please refer
to code for proper implementation.

procedure scanner
2:
scan Wi-Fi and list all ac
3:
get BSSID of best access4:
ping to best BSSID and r
5:while list do
6:parse all the data
7:
write data in file8:
List
ListEntry!ne9:
end while
10: end procedure

Figure 6: SCANNER (for dapseudo code

Figure 8: Wi-Fi heat Map generated using WiPi for 2.4GHz access points

Figure 5: Working snapshot of admin paneldo is to register this Pi through website and enter theregistration number in specified file of Pi.

5. RELATED WORKIn today’s market, there are other Wi-Fi heat-mappers
available like Wi-Spy[4] and Ekahau[3]. These software
also plots the heat map of Wi-Fi signal but procedure
is completely di↵erent. Unlike Wi-Pi, some of thesesituati
are commercial software and some needs proprietary situatio
bleassashardware. Most of these software does not provide a ble
Install
continuous evaluation and real-time analysis of Wi-Fi Installi
withtht
signal strength. This is mostly because these software withdoisistot
requires human resource to walk around the area that doregistr
needs to be analyzed to collect the data, but if the area registra
is very large then the cost of maintenance and analysis
5.5. RR
increases.
Few software like Ekahau requires a map of the area
IntotIn(c) Best latency rate (per 5 (d) Worst latency rate (per 5 (a)Worst hourly
hourly strength
strength(a) BestBest hourly
hourly strength
strength (per (b) Worst
input. Cisco Spectrum
Expert minutes)
Wi-Fi[2] result
is a Cisco
availabavailabminutes) results between pi(a) minutes) results between pi(c) 55 asminutes)
beminutes) result
result between
between (per 5 minutes)
result beproprietary
network cards. also
alsoplopand ap(1)and ap(2)pi(d)
andtweenwithpi(a)Ciscoand ap(3)
ap(3)
pi(d)
and ap(3)ap(3)software that works
pi(a)
and
This software is also similar to other software men- isis com
com
tioned, with some additional features like, locating video areare comcocamera, see hacked or rogue Wi-Fi devices.
hardwahardw
Wi-Pi is unique in terms of visualizing the network continu
continon Google maps, i.e. plot using latitude and longitude. signalsignals
Wi-Pi is a stationary and distributed approach that also require
requirgives the performance analysis of network. Wi-Pi also needs
needstmonitors the network even if network is down, but stor- isisveryvery
ing the data. Unlike these softwares, we need to think increas
increaFewfloor-wisevisualization
heat map. rate (per 5Few(c)about
Best latency
latency raterate(per 55 (d)(d) ofWorst(c)Best(perWorst latency
latency rate (per 5as
inpuas inpminutes) results between pi(a) minutes) results between pi(c)(e) Best packet loss (per 5 (f) Worst packet loss (per 5 minutes) results between pi(a) minutes) results between pi(c)proprie
6. ap(1)
CONCLUSION AND
FUTURE
WORKandand ap(2)propriandap(2)minutes) results between pi(a) minutes) results between pi(c) and ap(1)Thissoand ap(1)and ap(2)This paper introduced Wi-Pi which is a simple, static This stioned,and cost efficient method of assessing Wi-Fi performance tionedcameraFigure 9: Wi-Pi monitoring results in IIT Hybased on the actual feedback from Wi-Fi clients. The camer
Wi-Pderabad. Red bar in above figure represents theWismall deployment has been done in IIT Hyderabad’sWi-­‐Pi	  (2/2)	

(a) Best hourly strength (per (b) Worst hourly strength
5 minutes) result between (per 5 minutes) result bepi(d) and ap(3)tween pi(a) and ap(3)• Historical	  ﬂuctua:on	  of	  signal	  strength	  and	  network	  connec:vity	  • Android	  Apps	  for	  further	  cost	  reduc:on