Coordinated sampling sans Origin-Destination identifiers: Algorithms and analysis

Flow monitoring is used for a wide range of network management applications. Many such applications require that the monitoring infrastructure provide high flow coverage and support fine-grained network-wide objectives. Coordinated Sampling (cSamp) is a recent proposal that improves the monitoring capabilities of ISPs to address these demands. In this paper, we address a key deployment impediment for cSamp-like solutions-the need for routers to determine the Origin-Destination (OD) pair of each packet. In practice, however, this information is not available without expensive changes. We present a new framework called cSamp-T, in which each router uses only local information, instead of the OD-pair identifiers. Leveraging results from the theory of maximizing sub-modular set functions, cSamp-T provides near-ideal performance in maximizing the total flow coverage in the network. Further, with a small amount of targeted upgrades to a few routers, cSamp-T nearly optimally maximizes the minimum fractional coverage across all OD-pairs. We demonstrate these results on a range of real topologies.

[1]  Vyas Sekar,et al.  SmartRE: an architecture for coordinated network-wide redundancy elimination , 2009, SIGCOMM '09.

[2]  Nicolas Hohn,et al.  Inverting sampled traffic , 2003, IMC '03.

[3]  Walter Willinger,et al.  cSamp: A System for Network-Wide Flow Monitoring , 2008, NSDI.

[4]  Ramana Rao Kompella,et al.  The power of slicing in internet flow measurement , 2005, IMC '05.

[5]  Hervé Rivano,et al.  Optimal positioning of active and passive monitoring devices , 2005, CoNEXT '05.

[6]  Hong Yan,et al.  A clean slate 4D approach to network control and management , 2005, CCRV.

[7]  Anja Feldmann,et al.  Deriving traffic demands for operational IP networks: methodology and experience , 2001, TNET.

[8]  George Varghese,et al.  Network algorithmics , 2004 .

[9]  Matthew Roughan,et al.  Computation of IP traffic from link , 2003, SIGMETRICS 2003.

[10]  Zhi-Li Zhang,et al.  Profiling internet backbone traffic: behavior models and applications , 2005, SIGCOMM '05.

[11]  Katerina J. Argyraki,et al.  Loss and Delay Accountability for the Internet , 2007, 2007 IEEE International Conference on Network Protocols.

[12]  Andreas Krause,et al.  Selecting Observations against Adversarial Objectives , 2007, NIPS.

[13]  Nick Feamster,et al.  Fast monitoring of traffic subpopulations , 2008, IMC '08.

[14]  Michael K. Reiter,et al.  Finding Peer-to-Peer File-Sharing Using Coarse Network Behaviors , 2006, ESORICS.

[15]  Donald F. Towsley,et al.  Locating network monitors: complexity, heuristics, and coverage , 2005, INFOCOM.

[16]  Christophe Diot,et al.  Diagnosing network-wide traffic anomalies , 2004, SIGCOMM.

[17]  Michel Minoux,et al.  Accelerated greedy algorithms for maximizing submodular set functions , 1978 .

[18]  C. Guestrin,et al.  Near-optimal sensor placements: maximizing information while minimizing communication cost , 2006, 2006 5th International Conference on Information Processing in Sensor Networks.

[19]  David A. Maltz,et al.  Worm origin identification using random moonwalks , 2005, 2005 IEEE Symposium on Security and Privacy (S&P'05).

[20]  L. Wolsey.  Maximising Real-Valued Submodular Functions: Primal and Dual Heuristics for Location Problems , 1982, Math. Oper. Res..

[21]  John W. Byers,et al.  Scalable Coordination Techniques for Distributed Network Monitoring , 2005, PAM.

[22]  Carsten Lund,et al.  Online identification of hierarchical heavy hitters: algorithms, evaluation, and applications , 2004, IMC '04.

[23]  Ratul Mahajan,et al.  Measuring ISP topologies with rocketfuel , 2002, TNET.

[24]  M. L. Fisher,et al.  An analysis of approximations for maximizing submodular set functions—I , 1978, Math. Program..

[25]  M. V. Ramakrishna,et al.  Efficient Hardware Hashing Functions for High Performance Computers , 1997, IEEE Trans. Computers.

[26]  Andreas Krause,et al.  Near-optimal sensor placements in Gaussian processes , 2005, ICML.

[27]  Christophe Diot,et al.  Reformulating the Monitor Placement Problem: Optimal Network-Wide Sampling , 2006 .

[28]  Paul Francis,et al.  CONMan: a step towards network manageability , 2007, SIGCOMM 2007.

[29]  Albert G. Greenberg,et al.  Fast accurate computation of large-scale IP traffic matrices from link loads , 2003, SIGMETRICS '03.

[30]  George Varghese,et al.  Building a better NetFlow , 2004, SIGCOMM 2004.

[31]  Abhishek Kumar,et al.  Data streaming algorithms for efficient and accurate estimation of flow size distribution , 2004, SIGMETRICS '04/Performance '04.

[32]  Carsten Lund,et al.  Charging from sampled network usage , 2001, IMW '01.

[33]  Cristian Estan,et al.  New directions in traffic measurement and accounting , 2001, IMW '01.

[34]  Vyas Sekar,et al.  Coordinated Sampling sans Origin-Destination Identifiers : Algorithms , Analysis , and Evaluation , 2009 .