Reclaiming network-wide visibility using ubiquitous endsystem monitors

  • Authors:
  • Evan Cooke;Richard Mortier;Austin Donnelly;Paul Barham;Rebecca Isaacs

  • Affiliations:
  • University of Michigan;Microsoft Research, Cambridge;Microsoft Research, Cambridge;Microsoft Research, Cambridge;Microsoft Research, Cambridge

  • Venue:
  • ATEC '06 Proceedings of the annual conference on USENIX '06 Annual Technical Conference
  • Year:
  • 2006

Quantified Score

Hi-index 0.00

Visualization

Abstract

Network-centric tools like NetFlow and security systems like IDSes provide essential data about the availability, reliability, and security of network devices and applications. However, the increased use of encryption and tunnelling has reduced the visibility of monitoring applications into packet headers and payloads (e.g. 93% of traffic on our enterprise network is IPSec encapsulated). The result is the inability to collect the required information using network-only measurements. To regain the lost visibility we propose that measurement systems must themselves apply the end-to-end principle: only endsystems can correctly attach semantics to traffic they send and receive. We present such an end-to-end monitoring platform that ubiquitously records per-flow data and then we show that this approach is feasible and practical using data from our enterprise network.