Adaptive random sampling for load change detection
SIGMETRICS '02 Proceedings of the 2002 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
New directions in traffic measurement and accounting
Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications
Properties and prediction of flow statistics from sampled packet streams
Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
MMH: Software Message Authentication in the Gbit/Second Rates
FSE '97 Proceedings of the 4th International Workshop on Fast Software Encryption
Proceedings of the 3rd ACM SIGCOMM conference on Internet measurement
Proceedings of the 3rd ACM SIGCOMM conference on Internet measurement
Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications
Understanding Internet traffic streams: dragonflies and tortoises
IEEE Communications Magazine
Web traffic modeling exploiting TCP connections' temporal clustering through HTML-REDUCE
IEEE Network: The Magazine of Global Internetworking
Algorithms for packet classification
IEEE Network: The Magazine of Global Internetworking
Monitoring Flow Aggregates with Controllable Accuracy
MMNS '07 Proceedings of the 10th IFIP/IEEE International Conference on Management of Multimedia and Mobile Networks and Services: Real-Time Mobile Multimedia Services
Hi-index | 0.24 |
In this paper, we present design principles and related implementation experience for building effective and scalable IP flow monitoring systems. We focus on the monitoring of high-speed links, where the short packet inter-arrival time and the huge number of simultaneous flows impose a number of challenging requirements. First, the small inter-arrival times imply that algorithms for packet attribution to flows must be fast and efficient. To this purpose, an appropriate model for hash-based packet classification is proposed. Second, also the update of per-flow information must be fast, which suggests that fast memories are needed in order to avoid that memory access becomes the system bottleneck. But fast memories are still expensive and small, while the number of simultaneous flow in high-speed links is large. Therefore, the need arises to introduce strategies that help in keeping memory requirements low: one of these is the fast identification of timed out flows. Finally, identifying and periodically reporting information about long-lived flows receiving a lot of traffic is of paramount importance for those applications that cannot simply wait for the termination of these flows to receive the corresponding information. We provide design principles and algorithms that can be applied to all these tasks. A comparative study of some of them is carried out and performance figures are obtained using significant metrics.