MTS: Bringing Multi-Tenancy to Virtual Networking
summary
MTS isolates tenant networks by moving virtual switching into dedicated VMs and connecting tenant VMs via SR‑IOV virtual functions on a Mellanox ConnectX‑4 NIC, running Open vSwitch in user space (DPDK) under QEMU/KVM. Experiments show MTS moves virtual switch into VM and uses SR‑IOV to give VF ports and achieves about 1.5–2x throughput with one extra core versus host OVS (up to ~2x for p2v workloads), runs 12 vSwitches across 4 VMs today, and exposes VF count and PCIe bottlenecks and no clean live‑migration path.
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:35Virtual Networks Using Virtual Switches
- 1:22More Than 20 Virtual Switches
- 1:47Processes Untrusted Data
- 2:06Privileged Packet Processing
- 2:25Single Point of Failure
- 2:52Co-Located with the Host OS
- 3:08Exploiting Virtual Switches in the Cloud
- 3:55MTS: Multi-Tenant Switch
- 4:13Least Privilege Virtual Switch
- 4:35Least Common Mechanism
- 5:01Extra Security Boundary
- 5:13Complete Mediation
- 6:08Evaluation
- 6:45Shared Resources
- 7:35Traffic Patterns
- 8:13Baseline vs MTS
- 10:22Scaling MTS
- 11:00Pros and cons
- 12:10Tenant Specific Virtual Switch Software
- 12:39Conclusion
related talks
17mMultitenant In-Network Acceleration with SwitchVM
17mOSMOSIS: Enabling Multi-Tenancy in Datacenter SmartNICs
27mNetwork Multi-tenancy in Xen-based Clouds
20mNetKernel: Making Network Stack Part of the Virtualized Infrastructure
33mMulti-tenant K8s Networking with Kube-OVN
27mImplementing SR-IOV Failover for Windows Guests During Migration
22mConnecting virtual machines in the cloud age
35mWhy OCP networking performances on VMs are suboptimal and how to improve them by 5x