SDN-Mon: Fine-Grained Traffic Monitoring Framework in Software-Defined Networks

Abstract

Fine-grained network traffic monitoring is important for efficient network management in software-defined networking (SDN). The current SDN architecture, i.e., OpenFlow, relies on counters in the flow entries of forwarding tables for such monitoring tasks. This is not efficient nor flexible since the packet-header fields that users aim for monitoring are not always the same or overlap with those in OpenFlow match fields, which is designed for forwarding as a higher priority. This inflexibility may result in unnecessary flow entries added to switches for monitoring and controller-switch monitoring-based communication overhead, which may cause the communication channel to become a bottleneck, especially when the network includes a large number of switches. We propose SDN-Mon, a SDN-based monitoring framework that decouples monitoring from existing forwarding tables, and allows more fine-grained and flexible monitoring to serve a variety of network-management applications. SDN-Mon allows the controller to define the arbitrary sets of monitoring match fields based on the requirements of controller applications to flexibly monitor traffic. In SDN-Mon, some monitoring processes are selectively delegated to SDN switches to leverage the computing processor of the switch and avoid an unnecessary overhead in the controller-switch communication for monitoring. We implemented SDN-Mon and evaluated its performance on Lagopus switch, a high-performance software switch.

Implementing an intrusion detection and prevention system using software-defined networking: Defending against port-scanning and denial-of-service attacks

“…This pairing of algorithms has previously been shown to perform well in simulations using TCP network traffic [21,19]. [22] is an SDN-based framework for efficiently providing switch statistics that can be used by a variety of monitoring applications. The authors evaluate the performance of their system and show that it can provide improved monitoring capabilities in a trade-off with switch speed.…”

A Survey on Autonomic Provisioning and Management of QoS in SDN Networks

“…The authors in [177] decouple monitoring from the forwarding process. They create a separate monitoring table with match fields similar to those in the flow table.…”

“…They are used to configure the monitoring process within the switch (e.g., enable or disable, change matching fields). Then the authors tried in [178] to distribute the monitoring load of flows between network switches. Since the controller has the global view of the monitoring data, flows that are monitored by multiples switches are filtered.…”

Tennison: A Distributed SDN Framework for Scalable Network Security

“…SDNMon [19] seeks to improve on monitoring application granularity with an SDN monitoring framework that separates the monitoring logic from the forwarding logic. SDNMon achieves monitoring in a similar way to TENNISON by using multiple tables to separate monitoring and forwarding.…”