One Sketch to Rule Them All: Rethinking Network Flow Monitoring with UnivMon
By Zaoxing Liu, Antonis Manousis, Gregory Vorsanger, Vyas Sekar, Vladimir Braverman. Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, 2016
672 citations recorded by the source corpus.
Network management requires accurate estimates of metrics for traffic engineering (e.g., heavy hitters), anomaly detection (e.g., entropy of source addresses), and security (e.g., DDoS detection). Obtaining accurate estimates given router CPU and memory constraints is a challenging problem. Existing approaches fall in one of two undesirable extremes: (1) low fidelity general-purpose approaches such as sampling, or (2) high fidelity but complex algorithms customized to specific application-level metrics. Ideally, a solution should be both general (i.e., supports many applications) and provide accuracy comparable to custom algorithms. This paper presents UnivMon, a framework for flow monitoring which leverages recent theoretical advances and demonstrates that it is possible to achieve both generality and high accuracy. UnivMon uses an application-agnostic data plane monitoring primitive; different (and possibly unforeseen) estimation algorithms run in the control plane, and use the statistics from the data plane to compute application-level metrics. We present a proof-of-concept implementation of UnivMon using P4 and develop simple coordination techniques to provide a ``one-big-switch'' abstraction for network-wide monitoring. We evaluate the effectiveness of UnivMon using a range of trace-driven evaluations and show that it offers comparable (and sometimes better) accuracy relative to custom sketching solutions.
Subfields: Computer Networks and Communications
View Paper: https://www.semanticscholar.org/paper/7efe0dc4cde074bd87089491a6f95dde84397cca
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Computer Networks and Communications
- Jennifer Rexford
- N. Feamster
- Changhoon Kim
- Anirudh Sivaraman
- Srinivas Narayana
- Walter Willinger
- Qun Huang
- Venkat Arun
Citations in the corpus
- Heavy-Hitter Detection Entirely in the Data Plane (2016, methodology): “UnivMon [25] uses a top-k detection sketch internally as a subroutine in its “universal” sketch, to determine more general statistics about the network tra c.”
- SketchVisor: Robust Network Measurement for Software Packet Processing (2017, methodology): “SketchVisor’s design follows the line of software-defined measurement [23, 30, 36, 37, 56].”
- Sonata: query-driven streaming network telemetry (2018, methodology): “All-SP Mirror all incoming packets to the stream processor Gigascope[10],OpenSOC[40], NetQRE[58] Filter-DP Apply only filter operations on the switch EverFlow[60] Max-DP Execute asmanydataflowoperationsas possible on the switch Univmon[26],OpenSketch[56] Fix-REF Iteratively zoom-in one refinenement ”
- Language-Directed Hardware Design for Network Performance Monitoring (2017, methodology): “Sketches [34, 48, 49, 52, 63] and programmable switch counters [38, 54] expose traffic volume statistics using summary data structures and flow counters on switches.”