Ye Yu
ABSTRACT
Network traffic monitoring supports fundamental network management tasks. However, monitoring tasks introduce non-trivial overhead to network devices such as switches. We propose a Distributed and Collaborative Monitoring system, named DCM, with the following properties. First, DCM allows switches to collaboratively achieve flow monitoring tasks and balance measurement load. Second, DCM is able to perform per-flow monitoring, by which different groups of flows are monitored using different actions. Third, DCM is a memory-efficient solution for switch data plane and guarantees system scalability. DCM uses novel two-stage Bloom filters to represent monitoring rules using small memory space. It utilizes the centralized SDN control to install, update, and reconstruct the two-stage Bloom filters in the switch data plane. We study how DCM performs two representative monitoring tasks, namely flow size counting and packet sampling, and evaluate its performance. Experiments using real data center and ISP traffic data on real network topologies show that DCM achieves highest measurement accuracy among existing solutions given the same memory budget of switches.
- The caida ucsd anonymized internet traces 2013 - 2014. mar. http://www.caida.org/data/passive/passive_2013_dataset.xml.Google Scholar
- M. Al-Fares, A. Loukissas, and A. Vahdat. A scalable, commodity data center network architecture. In Proc. of ACM SIGCOMM, 2008. Google ScholarDigital Library
- T. Benson, A. Akella, and D. A. Maltz. Network traffic characteristics of data centers in the wild. In Proceedings of ACM IMC, 2010. Google ScholarDigital Library
- T. Benson, A. Anand, A. Akella, and M. Zhang. Microte: fine grained traffic engineering for data centers. In Proc. of ACM CoNEXT, 2011. Google ScholarDigital Library
- B. H. Bloom. Space/time trade-offs in hash coding with allowable errors. Communications of the ACM, 13(7):422--426, 1970. Google ScholarDigital Library
- J. Byers, J. Considine, M. Mitzenmacher, and S. Rost. Informed content delivery across adaptive overlay networks. In Proc. of ACM SIGCOMM, 2002. Google ScholarDigital Library
- S. R. Chowdhury, M. F. Bari, R. Ahmed, and R. Boutaba. Payless: A low cost netowrk monitoring framework for software defined networks. In Proc. of IEEE/IFIP NOMS, 2014.Google ScholarCross Ref
- B. Claise. Cisco systems netflow services export version 9, 2004.Google Scholar
- G. Cormode and S. Muthukrishnan. An improved data stream summary: the count-min sketch and its applications. Journal of Algorithms, 55(1):58--75, 2005. Google ScholarDigital Library
- L. Fan, P. Cao, J. Almeida, and A. Z. Broder. Summary cache: a scalable wide-area web cache sharing protocol. IEEE/ACM Transactions on Networking, 8(3):281--293, 2000. Google ScholarDigital Library
- W. Feng, K. G. Shin, D. D. Kandlur, and D. Saha. The blue active queue management algorithms. IEEE/ACM Transactions on Networking, 10(4):513--528, 2002. Google ScholarDigital Library
- A. Goel and P. Gupta. Small subset queries and bloom filters using ternary associative memories, with applications. In Proc. of ACM SIGMETRICS, 2010. Google ScholarDigital Library
- Y. Kanizo, D. Hay, and I. Keslassy. Palette: Distributing tables in software-defined networks. In Proc. of IEEE INFOCOM, 2013.Google ScholarCross Ref
- D. Li, H. Cui, Y. Hu, Y. Xia, and X. Wang. Scalable data center multicast using multi-class bloom filter. In Proc. of IEEE ICNP, 2011. Google ScholarDigital Library
- T. Mishra and S. Sahni. Duo-dual tcam architecture for routing tables with incremental update. In Proc. of IEEE ISCC, 2010. Google ScholarDigital Library
- M. Moshref, M. Yu, and R. Govindan. Resource/accuracy tradeoffs in software-defined measurement. In Proc. of ACM HotSDN, 2013. Google ScholarDigital Library
- T. Pan, X. Guo, C. Zhang, J. Jiang, H. Wu, and B. Liu. Tracking millions of flows in high speed networks for application identification. In Proc. of IEEE INFOCOM, 2012.Google Scholar
- P. Phaal and M. Lavine. sflow version 5, 2004.Google Scholar
- A. Ramachandran, S. Seetharaman, N. Feamster, and V. Vazirani. Fast monitoring of traffic subpopulations. In Proc. of ACM IMC, 2008. Google ScholarDigital Library
- V. Sekar, A. Gupta, M. K. Reiter, and H. Zhang. Coordinated sampling sans origin-destination identifiers: algorithms and analysis. In Proc. of IEEE COMSNETS, 2010. Google ScholarDigital Library
- V. Sekar, M. K. Reiter, W. Willinger, H. Zhang, R. R. Kompella, and D. G. Andersen. csamp: A system for network-wide flow monitoring. In Proc. of USENIX NSDI, 2008. Google ScholarDigital Library
- V. Sekar, M. K. Reiter, and H. Zhang. Revisiting the case for a minimalist approach for network flow monitoring. In Proc. of ACM IMC, 2010. Google ScholarDigital Library
- S. Shen and A. Akella. Decor: a distributed coordinated resource monitoring system. In Proc. of IEEE IWQoS, 2012. Google ScholarDigital Library
- A. C. Snoeren, C. Partridge, L. A. Sanchez, C. E. Jones, F. Tchakountio, B. Schwartz, S. T. Kent, and W. T. Strayer. Single-packet ip traceback. IEEE/ACM Transactions on Networking, 10(6):721--734, 2002. Google ScholarDigital Library
- N. Spring, R. Mahajan, and D. Wetherall. Measuring isp topologies with rocketfuel. 2002.Google Scholar
- Y. Xie, V. Sekar, D. A. Maltz, M. K. Reiter, and H. Zhang. Worm origin identification using random moonwalks. In Proc. of IEEE S&P, 2005. Google ScholarDigital Library
- M. Yu, A. Fabrikant, and J. Rexford. Buffalo: Bloom filter forwarding architecture for large organizations. In Proceedings of ACM CoNEXT, 2009. Google ScholarDigital Library
- M. Yu, L. Jose, and R. Miao. Software defined traffic measurement with opensketch. In Proc. of USENIX NSDI, 2013. Google ScholarDigital Library
- M. Yu, J. Rexford, M. J. Freedman, and J. Wang. Scalable flow based networking with difane. In Proc. of ACM SIGCOMM, 2010. Google ScholarDigital Library
- Y. Zhang. An adaptive flow counting method for anomaly detection in sdn. In Proc. of ACM CoNEXT, 2013. Google ScholarDigital Library
Index Terms
- Distributed and collaborative traffic monitoring in software defined networks
Recommendations
Quality of Service (QoS) in Software Defined Networking (SDN)
Supporting end-to-end Quality of Service (QoS) in existing network architectures is an ongoing problem. Although researchers from both academia and industry have proposed many solutions to solve the QoS limitations of the current networking, many of ...
A New Network Traffic Prediction Approach in Software Defined Networks
AbstractSoftware Defined Networking (SDN) is a centralized management network architecture, the handling commands of flows are designed in the controller and installed into flow tables of OpenFlow switches. SDN has obtained a lot of attention due to ...
A New Traffic Prediction Algorithm to Software Defined Networking
AbstractTraffic prediction is significantly important for performance analysis and network planning in Software Defined Networking (SDN). However, to effectively predict network traffic in current networks is very difficult and nearly prohibitive. As a ...
Comments