Fast monitoring of traffic subpopulations

Anirudh Ramachandran, Srinivasan Seetharaman, Nicholas G. Feamster, Vijay Vazirani

Research output: Chapter in Book/Report/Conference proceedingConference contribution

42 Scopus citations

Abstract

Network accounting, forensics, security, and performance monitoring applications often need to examine detailed traces from subsets of flows ("subpopulations"), where the application requires flexibility in specifying the subpopulation (e.g., to detect a portscan, the application must observe many packets between a source and a destination with one packet to each port). Unfortunately, the dynamism and volume of network traffic on many high-speed links requires traffic sampling, which adversely affects subpopulation monitoring: because many subpopulations of interest to operators are low-volume flows, conventional sampling schemes (e.g., uniform random sampling) can miss much of the subpopulation's traffic. Today's routers and network devices provide scant support for monitoring specific traffic subpopulations. This paper presents the design, implementation, and evaluation of FlexSample, a traffic monitoring framework that dynamically extracts traffic from subpopulations that operators define using conditions on packet header fields. FlexSample uses a fast, flexible counter array to provide rough estimates of packets' membership in respective subpopulations. Based on these coarse estimates, FlexSample then makes per-packet sampling decisions to sample proportionately from each subpopulation (as specified by a network operator), subject to an overall sampling constraint. We apply FlexSample to extract subpopulations such as port scans and traffic to high-degree nodes and find that it can capture significantly more packets from these subpopulations than conventional approaches.

Original languageEnglish (US)
Title of host publicationIMC'08
Subtitle of host publicationProceedings of the 2008 ACM SIGCOMM Internet Measurement Conference
Pages257-270
Number of pages14
DOIs
StatePublished - Dec 1 2008
EventInternet Measurement Conference 2008, IMC'08 - Vouliagmeni, Greece
Duration: Oct 20 2008Oct 22 2008

Publication series

NameProceedings of the ACM SIGCOMM Internet Measurement Conference, IMC

Other

OtherInternet Measurement Conference 2008, IMC'08
CountryGreece
CityVouliagmeni
Period10/20/0810/22/08

All Science Journal Classification (ASJC) codes

  • Software
  • Computer Networks and Communications

Keywords

  • Counters
  • Flexsample
  • Sampling
  • Traffic statistics
  • Traffic subpopulations

Fingerprint Dive into the research topics of 'Fast monitoring of traffic subpopulations'. Together they form a unique fingerprint.

  • Cite this

    Ramachandran, A., Seetharaman, S., Feamster, N. G., & Vazirani, V. (2008). Fast monitoring of traffic subpopulations. In IMC'08: Proceedings of the 2008 ACM SIGCOMM Internet Measurement Conference (pp. 257-270). (Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC). https://doi.org/10.1145/1452520.1452551