Network-Wide Heavy Hitter Detection with Commodity Switches

Harrison, Rob; Cai, Qizhe; Gupta, Arpit; Rexford, Jennifer

doi:10.1145/3185467.3185476

Cited by 84 publications

(64 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Sonata provides a foundation for much future work. First, we are currently extending Sonata to support telemetry applications such as network-wide heavy hitter detection [18] that require observing traffic at multiple locations. Second, we plan to improve on Sonata's query planning by developing new (1) methods to minimize the amount of packet traces required, (2) heuristics for expediting the computation of query plans, and (3) techniques to make the query planning more robust.…”

Section: Resultsmentioning

confidence: 99%

Sonata

Gupta

Harrison

Canini

et al. 2018

Proceedings of the 2018 Conference of the ACM Special Interest Group on Data Communication

Self Cite

177

View full text Add to dashboard Cite

Managing and securing networks requires collecting and analyzing network traffic data in real time. Existing telemetry systems do not allow operators to express the range of queries needed to perform management or scale to large traffic volumes and rates. We present Sonata, an expressive and scalable telemetry system that coordinates joint collection and analysis of network traffic. Sonata provides a declarative interface to express queries for a wide range of common telemetry tasks; to enable real-time execution, Sonata partitions each query across the stream processor and the data plane, running as much of the query as it can on the network switch, at line rate. To optimize the use of limited switch memory, Sonata dynamically refines each query to ensure that available resources focus only on traffic that satisfies the query. Our evaluation shows that Sonata can support a wide range of telemetry tasks while reducing the workload for the stream processor by as much as seven orders of magnitude compared to existing telemetry systems.

show abstract

Section: Resultsmentioning

confidence: 99%

Sonata

Gupta

Harrison

Canini

et al. 2018

Proceedings of the 2018 Conference of the ACM Special Interest Group on Data Communication

Self Cite

177

View full text Add to dashboard Cite

show abstract

“…Even with this approach sometimes we need to collect from a selected node statistics to a central server. For example in [15] a low-overhead network-wide heavy hitter detection is done where large flows are detected locally in the data-plane with a per-key threshold that triggers reports to a central coordinator. A similar approach is used in [16].…”

Section: B Discussionmentioning

confidence: 99%

Low-Overhead Near-Real-Time Flow Statistics Collection in SDN

Nougnanke

Bruyère

Labit

2020

2020 6th IEEE Conference on Network Softwarization (NetSoft)

View full text Add to dashboard Cite

In Software-Defined Networking, near-real-time collection of flow-level statistics provided by OpenFlow (e.g. byte count) is needed for control and management applications like traffic engineering, heavy hitters detection, attack detection, etc. The practical way to do this near-real-time collection is a periodic collection at high frequency. However, periodic polling may generate a lot of overheads expressed by the number of OpenFlow request and reply messages on the control network. To handle these overheads, adaptive techniques based on the pull model were proposed. But we can do better by detaching from the classical OpenFlow request-reply model for the particular case of periodic statistics collection. In light of this, we propose a push and prediction based adaptive collection to handle efficiently periodic OpenFlow statistics collection while maintaining good accuracy. We utilize the Ryu Controller and Mininet to implement our solution and then we carry out intensive experiments using real-world traces. The results show that our proposed approach can reduce the number of pushed messages up to 75% compared to a fixed periodic collection with a very good accuracy represented by a collection error of less than 0.5%.

show abstract

“…Tal identificaçãoéútil para detectar os nós que estejam consumindo a maioria dos recursos de uma rede. Ela pode ser utilizada para, por exemplo, detectar ataques DDoS [Harrison et al 2018].…”

Section: Detecção De Heavy Hittersunclassified

Aplicações de monitoramento de tráfego utilizando redes programáveis eBPF

Santos¹,

Júnior²,

Vieira³

et al. 2019

Anais Do XXXVII Simpósio Brasileiro De Redes De Computadores E Sistemas Distribuídos (SBRC 2019)

View full text Add to dashboard Cite

Monitoramento de tráfego é uma ferramenta importante em engenharia de tráfego, permitindo que gerentes de rede possam detectar ataques e comportamentos anormais da rede. O paradigma de SDN prove uma nova alternativa para fazer isso, separando o plano de dados e controle e os permitindo ser programáveis. Neste trabalho é proposto a implementação de aplicações para monitoramento de redes utilizando o BPFabric, uma arquitetura flexível e programável para switches que utiliza uma máquina virtual eBPF para processamento de pacotes. As aplicações propostas utilizam abordagens baseadas em amostragem e outras estruturas de dados probabilísticas.

show abstract

Network-Wide Heavy Hitter Detection with Commodity Switches

Cited by 84 publications

References 18 publications

Sonata

Sonata

Low-Overhead Near-Real-Time Flow Statistics Collection in SDN

Aplicações de monitoramento de tráfego utilizando redes programáveis eBPF

Contact Info

Product

Resources

About