Sciweavers

CCR
2002

New directions in traffic measurement and accounting

13 years 9 months ago
New directions in traffic measurement and accounting
Accurate network traffic measurement is required for accounting, bandwidth provisioning and detecting DoS attacks. These applications see the traffic as a collection of flows they need to measure. As link speeds and the number of flows increase, keeping a counter for each flow is too expensive (using SRAM) or slow (using DRAM). The current state-of-the-art methods (Cisco's sampled NetFlow) which log periodically sampled packets are slow, inaccurate and resource-intensive. Previous work showed that at different granularities a small number of "heavy hitters" accounts for a large share of traffic. Our paper introduces a paradigm shift for measurement by concentrating only on large flows -- those above some threshold such as 0.1% of the link capacity. We propose two novel and scalable algorithms for identifying the large flows: sample and hold and multistage filters, which take a constant number of memory references per packet and use a small amount of memory. If M is the ...
Cristian Estan, George Varghese
Added 17 Dec 2010
Updated 17 Dec 2010
Type Journal
Year 2002
Where CCR
Authors Cristian Estan, George Varghese
Comments (0)