Per flow packet sampling for high-speed network monitoring

Authors:
Marco Canini;Damien Fay;David J. Miller;Andrew W. Moore;Raffaele Bolla
Affiliations:
DIST, University of Genoa, Italy;Computer Laboratory, University of Cambridge, UK;Computer Laboratory, University of Cambridge, UK;Computer Laboratory, University of Cambridge, UK;DIST, University of Genoa, Italy
Venue:
COMSNETS'09 Proceedings of the First international conference on COMmunication Systems And NETworks
Year:
2009

Citing 14
Cited 4

Summary cache: a scalable wide-area web cache sharing protocol

IEEE/ACM Transactions on Networking (TON)
New directions in traffic measurement and accounting

Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications
Universal classes of hash functions (Extended Abstract)

STOC '77 Proceedings of the ninth annual ACM symposium on Theory of computing
Sketch-based change detection: methods, evaluation, and applications

Proceedings of the 3rd ACM SIGCOMM conference on Internet measurement
Snort - Lightweight Intrusion Detection for Networks

LISA '99 Proceedings of the 13th USENIX conference on System administration
A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification

ACM SIGCOMM Computer Communication Review
Fast packet classification using bloom filters

Proceedings of the 2006 ACM/IEEE symposium on Architecture for networking and communications systems
Traffic classification through simple statistical fingerprinting

ACM SIGCOMM Computer Communication Review
The shunt: an FPGA-based accelerator for network intrusion prevention

Proceedings of the 2007 ACM/SIGDA 15th international symposium on Field programmable gate arrays
Building a time machine for efficient recording and retrieval of high-volume network traffic

IMC '05 Proceedings of the 5th ACM SIGCOMM conference on Internet Measurement
Early application identification

CoNEXT '06 Proceedings of the 2006 ACM CoNEXT conference
Less hashing, same performance: Building a better Bloom filter

Random Structures & Algorithms
A Machine Learning Approach for Efficient Traffic Classification

MASCOTS '07 Proceedings of the 2007 15th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems
Space-Code Bloom Filter for Efficient Per-Flow Traffic Measurement

IEEE Journal on Selected Areas in Communications

Efficient application identification and the temporal and spatial stability of classification schema

Computer Networks: The International Journal of Computer and Telecommunications Networking
Efficient packet sampling for accurate traffic measurements

Computer Networks: The International Journal of Computer and Telecommunications Networking
Scap: stream-oriented network traffic capture and analysis for high-speed networks

Proceedings of the 2013 conference on Internet measurement conference
Dynamic Binary User-Splits to Protect Cloud Servers from DDoS Attacks

Proceedings of the Second International Conference on Innovative Computing and Cloud Computing

Quantified Score

Hi-index	0.00

Visualization

Abstract

We present a per-flow packet sampling method that enables the real-time classification of high-speed network traffic. Our method, based upon the partial sampling of each flow (i.e., performing sampling at only early stages in each flow's lifetime), provides a sufficient reduction in total traffic (e.g., a factor of five in packets, a factor of ten in bytes) as to allow practical implementations at one Gigabit/s, and, using limited hardware assistance, ten Gigabit/s.