| Abstract: |
For Internet Service Provider (ISP), getting an accurate picture of how their network behaves is challenging. Given the traffic volumes they carry and the impossibility to control end-hosts,
they are typically forced to randomly sample traffic and rely on aggregated statistics. This provides them with coarse-grained visibility, at a less than ideal time resolution (seconds or
minutes). In this paper, we present Stroboscope, a system that complements existing tools (like NetFlow) by enabling fast fine-grained monitoring of any traffic flow. Stroboscope leverages the
ability of routers to mirror thin slices of traffic (few milliseconds) to an external collector, combining the scalability of sampling with the visibility and controllability of traffic
mirroring. Stroboscope takes as input high-level queries which specify which traffic to monitor and with which budget (e.g., max. 1 Gbps). Stroboscope then derives a low-level mirroring schedule
by determining: (i) what flows to mirror, considering unforeseen traffic dynamics; (ii) where to place these mirroring rules using fast and provably correct algorithms; (iii) when to schedule
them to maximize coverage while staying within the budget. We implemented Stroboscope and show that it scales both in terms of computation time (entire schedules are computed in seconds) and in
the number of mirroring rules (well within the limits of existing systems), while maximizing coverage and swiftly adapting to unforeseen traffic conditions such as traffic surges while
mirroring. |
