Distributed and Collaborative Traffic Monitoring in Software Defined Networks

Network traffic monitoring supports fundamental network manage-ment tasks. However, monitoring tasks introduce non-trivial over-head to network devices such as switches. We propose a Distributed and Collaborative Monitoring system, named DCM, with the fol-lowing properties. First, DCM allows switches to collaboratively achieve flow monitoring tasks and balance measurement load. Sec-ond, DCM is able to perform per-flow monitoring, by which dif-ferent groups of flows are monitored using different actions. Third, DCM is a memory-efficient solution for switch data plane and guar-antees system scalability. DCM uses novel two-stage Bloom filters to represent monitoring rules using small memory space. It utilizes the centralized SDN control to install, update, and reconstruct the two-stage Bloom filters in the switch data plane. We study how DCM performs two representative monitoring tasks, namely flow size counting and packet sampling, and evaluate its performance. Experiments using real data center and ISP traffic data on real net-work topologies show that DCM achieves highest measurement ac-curacy among existing solutions given the same memory budget of switches