[Paper Review] AppSwitch: Resolving the Application Identity Crisis

Dinesh Subhraveti, Sri Goli+3 more|arXiv (Cornell University)|Nov 7, 2017

Software-Defined Networks and 5G4 references3 citations

TL;DR

AppSwitch introduces a transport-layer network element that decouples applications from their underlying network by intercepting system calls, enabling application identity to be managed independently of host IP addresses. This design eliminates the performance overhead of traditional data path processing, achieving up to several times higher throughput by transparently using Unix sockets for local communication, and enables efficient, stateless network functions like load balancing and firewalls without application or infrastructure changes.

ABSTRACT

Networked applications traditionally derive their identity from the identity of the host on which they run. The default application identity acquired from the host results in subtle and substantial problems related to application deployment, discovery and access, especially for modern distributed applications. A number of mechanisms and workarounds, often quite elaborate, are used to address those problems but they only address them indirectly and incompletely. This paper presents AppSwitch, a novel transport layer network element that decouples applications from underlying network at the system call layer and enables them to be identified independently of the network. Without requiring changes to existing applications or infrastructure, it removes the cost and complexity associated with operating distributed applications while offering a number of benefits including an efficient implementation of common network functions such as application firewall and load balancer. Experiments with our implementation show that AppSwitch model also effectively removes the performance penalty associated with unnecessary data path processing that is typical in those application environments.

Motivation & Objective

• To address the fundamental problem of application identity being tightly coupled to host IP addresses in modern distributed and microservices architectures.
• To reduce operational complexity and performance penalties caused by indirect, incomplete workarounds for application discovery, segmentation, and load balancing.
• To enable efficient, stateless implementation of application-level network functions such as firewalls and load balancers by virtualizing the network API at the system call layer.
• To allow seamless operation across heterogeneous infrastructures—bare metal, VMs, containers, and cloud—without requiring application or infrastructure modifications.
• To provide a clean, scalable, and performant abstraction for application networking that supports dynamic, ephemeral, and mobile microservices.

Proposed method

• AppSwitch operates at the system call layer, intercepting socket-related system calls (e.g., socket, connect, bind, getsockname) to decouple applications from network infrastructure.
• It uses a kernel module or ptrace-based user-space mechanism to trap system calls and virtualize network identity and connectivity.
• The system maintains a service table mapping application-specified identities (IP, port, name, tag) to actual network endpoints, enabling cross-host discovery via a gossip protocol.
• For local communication between containers on the same host, AppSwitch transparently uses Unix domain sockets instead of TCP, avoiding unnecessary network stack traversal.
• The trap handler remains out of the data path after connection setup, minimizing performance overhead.
• AppSwitch integrates with existing infrastructure by requiring only a single configuration point to join a cluster, with no changes to applications or underlying systems.

Experimental results

Research questions

• RQ1 How can application identity be decoupled from host-level network identity in modern distributed systems?
• RQ2 What is the performance impact of traditional network stack traversal in colocated container communication, and how can it be eliminated?
• RQ3 Can application-level network functions like load balancing and firewalls be implemented efficiently without incurring data path processing costs?
• RQ4 How can a system be designed to support dynamic, mobile, and ephemeral microservices without requiring changes to applications or infrastructure?
• RQ5 What is the minimal, stable, and secure interception point in the system stack that enables virtualization of application network identity?

Key findings

• AppSwitch achieved significantly higher network throughput—several times higher than the standard Linux bridge—by avoiding hairpin traversal for colocated containers.
• Throughput increased with larger packet sizes, confirming that the performance benefit scales with workload characteristics.
• AppSwitch transparently used Unix domain sockets for local communication between containers on the same host, even when TCP was requested, eliminating unnecessary network stack processing.
• The system achieved full functionality without modifying applications or infrastructure, requiring only a single configuration point to join a cluster.
• The performance improvement was attributed to bypassing the data path after connection setup and avoiding redundant network stack processing.
• The design enables efficient, stateless implementation of network functions such as segmentation and load balancing by operating at the system call interface rather than the packet level.