## Locating network monitors: Complexity, heuristics and coverage (2005)

Venue: | in Proceedings of IEEE Infocom |

Citations: | 43 - 0 self |

### BibTeX

@INPROCEEDINGS{Suh05locatingnetwork,

author = {Kyoungwon Suh and Yang Guo},

title = {Locating network monitors: Complexity, heuristics and coverage},

booktitle = {in Proceedings of IEEE Infocom},

year = {2005}

}

### Years of Citing Articles

### OpenURL

### Abstract

Abstract — There is increasing interest in concurrent passive monitoring of IP flows at multiple locations within an IP network. The common objective of such a distributed monitoring system is to sample packets belonging to a large fraction of IP flows in a cost-effective manner by carefully placing monitors and controlling their sampling rates. In this paper, we consider the problem of where to place monitors within the network and how to control their sampling. To address the tradeoff between monitoring cost and monitoring coverage, we consider minimum cost and maximum coverage problems under various budget constraints. We show that all of the defined problems are NPhard. We propose greedy heuristics, and show that the heuristics provide solutions quite close to the optimal solutions through experiments using synthetic and real network topologies. In addition, our experiments show that a small number of monitors is often enough to monitor most of the traffic in an entire IP network. I.

### Citations

829 |
Neuro-dynamic programming
- Bertsekas, Tsitsiklis
- 1996
(Show Context)
Citation Context ...hanged sign as f. If f is a convex function, then a local minimum of f over X is a global minimum. If in addition f is strictly convex over X, then there exists at most one global minimum of f over X =-=[17]-=-. V. EVALUATION OF GREEDY HEURISTICS, COVERAGE, AND MARGINAL GAIN WITH ADDITIONAL MONITORING POINTS In this section, we evaluate the effectiveness of our approximation algorithms for BCMCP and BCMCP-S... |

664 | Measuring ISP topologies with rocketfuel
- Spring, Mahajan, et al.
- 2002
(Show Context)
Citation Context ...ting settings: We use both synthetic network topologies and a real ISP topology for our study. More specifically, we use the PoPlevel topology of Cable&Wireless, as inferred by the Rocketfuel project =-=[18, 19]-=-. Our synthetic topologies, consist of random topologies and Transit-Stub topologies generated by GT-ITM [20]. Unfortunately, neither the GT-ITM nor the Rocketfuel dataset provide traffic demand matri... |

337 | Internet traffic engineering by optimizing OSPF weights
- Fortz, Thorup
- 2000
(Show Context)
Citation Context ...ither the GT-ITM nor the Rocketfuel dataset provide traffic demand matrices for each topology generated or inferred. Therefore, in order to generate a traffic matrix, we use the technique proposed in =-=[21]-=-. In [21], a synthetic topology is produced using GT-ITM. The original topology model of GT-ITM places nodes in a unit square, thus generating a distance δ(x, y) between each pair of nodes. These dist... |

272 | Approximation algorithms for facility location problems
- Shmoys
- 2000
(Show Context)
Citation Context ... the set of locations to open facilities and an assignment of demand to the opened facilities, in order to minimize the total cost that is the sum of facility opening cost and the total shipping cost =-=[14, 15]-=-. D. Shmoys et al. proposed a polynomial-time approximation algorithm that finds a solution within a factor of (1 + 2/e) of the optimal, where 1 + 2/e ≈ 1.736. The approximation solution is obtained b... |

132 | The budgeted maximum coverage problem - Khuller, Moss, et al. - 1999 |

125 | On the placement of internet instrumentation - Jamin, Jin, et al. - 2000 |

117 | Inferring link weights using end-to-end measurements
- Mahajan, Spring, et al.
- 2002
(Show Context)
Citation Context ...ting settings: We use both synthetic network topologies and a real ISP topology for our study. More specifically, we use the PoPlevel topology of Cable&Wireless, as inferred by the Rocketfuel project =-=[18, 19]-=-. Our synthetic topologies, consist of random topologies and Transit-Stub topologies generated by GT-ITM [20]. Unfortunately, neither the GT-ITM nor the Rocketfuel dataset provide traffic demand matri... |

106 | On the marginal utility of network topology measurements
- Barford, Bestavros, et al.
- 2001
(Show Context)
Citation Context ...ocations of measurement devices are obtained using greedy heuristics. Horton et al. [6] determined the minimal number of required beacons on a network and their near-optimal locations. Barford et al. =-=[22]-=- presented empirical observations showing that the marginal utility of adding additional active measurement sites declines rapidly after the second or third site. In other words, both works show that ... |

91 | Properties and prediction of flow statistics from sampled packet streams
- Duffield, Lund, et al.
- 2002
(Show Context)
Citation Context ...ear function may be a reasonable candidate. Alternatively, we might choose a form of uj() that accounts for sampling errors, in which case uj() will also be a strictly non-decreasing concave function =-=[9, 10]-=-. III. A SET OF PASSIVE MONITORING PROBLEMS WITHOUT SAMPLING In this section, we introduce several monitoring problems under the assumption that each monitor collects all packets of monitored flows, i... |

73 | Design and Deployment of a Passive Monitoring Infrastructure”, Passive and Active Measurement Workshop
- Fraleigh, Diot, et al.
- 2001
(Show Context)
Citation Context ...inimal number of required beacons in a network and their optimal locations in order to obtain accurate Internet topology. While these works investigated active monitoring, the IPMon project at Sprint =-=[7]-=- deployed multiple passive packet-level monitors inside their network to capture IP headers. However, they consider neither the problem of monitor location nor the choice of sampling methodology insth... |

59 | Learn more, sample less: Control of volume and variance in network measurement
- Duffield, Lund, et al.
- 2005
(Show Context)
Citation Context ... system can be used to study packet-level traffic, estimate packet-size distributions, estimate the finedgrained volume of network traffic with different attributes for usage-based charging, and more =-=[1]-=-. In practice, a monitor is placed inside a router or deployed as a standalone measurement box that taps into a communication link. Once a monitor is placed on a link, it may capture or sample packets... |

59 | Feasibility of IP restoration in a tier 1 backbone - Iannaccone, Chuah, et al. - 2004 |

40 | Robust monitoring of link delays and faults in IP networks - Bejerano, Rastogi - 2003 |

36 | On the number of distributed measurement points for network tomography
- Horton, Lopez-Ortiz
- 2003
(Show Context)
Citation Context ...ance measurements (such as link delay and the existence of faults). The location of these active measurement devices or beacons has been determined using various heuristics [2–5]. Also, Horton et al. =-=[6]-=- determined the minimal number of required beacons in a network and their optimal locations in order to obtain accurate Internet topology. While these works investigated active monitoring, the IPMon p... |

36 | tech internetwork topology models. http://www.cc. gatech.edu/projects/gtitm - georgia |

33 | Robust Monitoring of Link Delays and Faults - Bejerano, Rastogi - 2003 |

23 | Distributed Network Monitoring with Bounded Link Utilization - Li, Thottan, et al. |

23 | Efficiently monitoring bandwidth and latency - Breibart, Chan, et al. - 2001 |

22 | Tree layout for internal network characterizations in multicast networks
- Adler, Bu, et al.
- 2001
(Show Context)
Citation Context ...et filtering systems. Also, we propose both deployment and operating strategies for distributed monitoring. C. Network tomography The objective of Minimum cost Multicast Tree Cover Problem (MMTCP) in =-=[24]-=- is: given a set of links whose behavior is of interest, how does one choose a set of minimum cost multicast trees within the network to determine the behavior of the links in question, particularly l... |

17 | Efficiently monitoring bandwidth and latency in IP networks - Breitbart, Chong, et al. - 2012 |

13 | Efficient monitoring of end-to-end network properties - Chua, Kolaczyk, et al. - 2005 |

12 |
Adaptive random sampling for traffic load measurement
- CHOI, PARK, et al.
- 2003
(Show Context)
Citation Context ... which is different from a passive measurement problem considered by MDCP. In addition, sampling is not considered in [24]. D. Sampling strategies Sampling methodologies at a single measurement point =-=[1, 9, 25]-=- are related to BCMCP-S. In practice, sampling accuracy may be measured by the magnitude of the variance or the relative size of the confidence interval to the mean value of unbiased estimators. If we... |

7 | Mixed-integer nonlinear optimization in process synthesis
- Adjiman, Schweiger, et al.
- 1998
(Show Context)
Citation Context ...j ∈ Si = 0, i ∈ L, j /∈ Si ∈ {0, 1}, i ∈ L ∈ [0, 1], i ∈ L, j ∈ SisIn general, it is difficult to directly obtain an optimal solution, because the yi’s are integer variables and uj() may be nonlinear =-=[16]-=-. For example, if we assume that monitors sample flows independently of each other, the objective function can be represented as � j∈D (uj(1 − � i∈L (1 − mij))). To obtain an optimal solution, we can ... |

5 |
The budgeted maximum coverage problem,” Information Processing Letters
- Khuller, Moss
- 1999
(Show Context)
Citation Context .... The objective is to determine a collection of sets Z ′ ⊆ Z, such that the total weight of elements covered by Z ′ is maximized, while the total cost of elements in Z ′ is less than a given budget K =-=[11]-=-. Here we only provide a sketch of the reduction. Readers are referred to the appendix for a complete proof of the reduction. Z maps to the set of links; the associated cost ci is mapped to the deploy... |

5 | Improved performance of the greedy algorithm for the minimum set cover and minimum partial cover problems
- Slavik
- 1995
(Show Context)
Citation Context ...] for a rigorous proof of NP-hardness. For the general case, we can get an (log(|D|) + 1)approximation solution by adapting the approximation algorithm for the partial K-set cover problem proposed in =-=[13]-=-. We present the approximation algorithm for MDCP in Figure 2, where fj denotes the monitor deployment cost at link j. In the first step of the algorithm, we normalize the utility values of monitored ... |

3 |
Tech Internetwork Topology Models. http://www.cc.gatech.edu/projects/gtitm
- GT-ITM
(Show Context)
Citation Context ... we use the PoPlevel topology of Cable&Wireless, as inferred by the Rocketfuel project [18, 19]. Our synthetic topologies, consist of random topologies and Transit-Stub topologies generated by GT-ITM =-=[20]-=-. Unfortunately, neither the GT-ITM nor the Rocketfuel dataset provide traffic demand matrices for each topology generated or inferred. Therefore, in order to generate a traffic matrix, we use the tec... |

3 | Sample Less: Control of Volume and Variance in Network Measurement - Duffield, Lund, et al. - 2005 |

1 |
On the placement of monitoring devices
- Sharma, Iannaccone, et al.
- 2004
(Show Context)
Citation Context ... headers. However, they consider neither the problem of monitor location nor the choice of sampling methodology instheir monitoring architecture. Recently, in parallel with our work, M. Sharma et al. =-=[8]-=- proposed a heuristic for locating passive monitors. However, they do not consider operating costs or a sampling mode of operation, and do not analyze the complexity of the formulated monitoring probl... |

1 |
sFlow accuracy and billing
- Corp
- 2001
(Show Context)
Citation Context ...ear function may be a reasonable candidate. Alternatively, we might choose a form of uj() that accounts for sampling errors, in which case uj() will also be a strictly non-decreasing concave function =-=[9, 10]-=-. III. A SET OF PASSIVE MONITORING PROBLEMS WITHOUT SAMPLING In this section, we introduce several monitoring problems under the assumption that each monitor collects all packets of monitored flows, i... |

1 |
Improved approximation algorithms for the unpacacitated facility location problem
- Chudak, Shmoys
(Show Context)
Citation Context ... the set of locations to open facilities and an assignment of demand to the opened facilities, in order to minimize the total cost that is the sum of facility opening cost and the total shipping cost =-=[14, 15]-=-. D. Shmoys et al. proposed a polynomial-time approximation algorithm that finds a solution within a factor of (1 + 2/e) of the optimal, where 1 + 2/e ≈ 1.736. The approximation solution is obtained b... |

1 |
On the effectiveness of routebasd packet filtering for distributed DoS attack prevention in power-law Internets
- Park, Lee
- 2001
(Show Context)
Citation Context ...verage. However, these earlier works were concerned with active, rather than passive, monitors. B. High coverage power with a small number of passive monitoring/filtering locations K. Park and H. Lee =-=[23]-=- showed that the well-known vertex cover problem can be used to approximate the problem of placing route-based packet filters on routers to prevent distributed DoS Attack. Since the vertex cover probl... |

1 | On the placement of monitoring devices in an IP network - Sharma, Iannaccone, et al. - 2004 |