Network monitoring is a vital part of modern network infrastructure management. Existing techniques either present a restricted view of network behavior and state, or do not efficiently scale to higher network speeds and heavier monitoring workloads. We present a novel architecture for programmable packet-level network monitoring that addresses these shortcomings. Our approach allows users to customize the monitoring function at the lowest possible level of abstraction to suit a wide range of monitoring needs: we use operating system mechanisms that result in a programming environment providing a high degree of flexibility, retaining fine-grained control over security, and minimizing the associated performance overheads. We present an implementation of this architecture as well as a set of experimental applications.
|
611
|
Decentralized trust management
– Blaze, Feigenbaum, et al.
- 1996
|
|
410
|
A BSD packet filter: A new architecture for user-level packet capture
– MCCANNE, JACOBSON
- 1993
|
|
400
|
Practical network support for IP traceback
– Savage, Wetherall, et al.
- 2000
|
|
193
|
Distributed management by delegation
– Goldszmidt, Yemini
- 1995
|
|
168
|
Controlling High Bandwidth Aggregates in the Network
– MAHAJAN, BELLOVIN, et al.
- 2002
|
|
148
|
An algebraic approach to ip traceback
– DEAN, FRANKLIN, et al.
- 2002
|
|
144
|
PLAN: A packet language for active networks
– Hicks, Kakkar, et al.
- 1998
|
|
133
|
An Architecture for Large-Scale Internet Measurement
– Paxson, Mahdavi, et al.
- 1998
|
|
132
|
TALx86: A realistic typed assembly language
– Morrisett, Crary, et al.
- 1999
|
|
131
|
Trajectory Sampling for Direct Traffic Observation
– Duffield, Grossglauser
- 2001
|
|
127
|
Remote Network Monitoring Management Information
– Waldbusser
- 2000
|
|
77
|
ICMP Traceback Messages
– Bellovin, Leech, et al.
- 2001
|
|
69
|
A Framework for Alternate Queueing: Towards Traffic Management by PC-UNIX Based Routers
– Cho
- 1998
|
|
63
|
OC3MON: Flexible, affordable, high performance statistics collection
– Apisdorf, claffy, et al.
- 1996
|
|
63
|
The stationarity of internet path properties: Routing, loss, and throughput
– Zhang, Paxson, et al.
- 2000
|
|
59
|
Ashs: Application-specific handlers for high-performance messaging
– Wallach, Engler, et al.
- 1996
|
|
58
|
A language-based approach to security
– Schneider, Morrisett, et al.
- 2000
|
|
52
|
An extensible probe architecture for network protocol performance measurement
– Malan, Jahanian
- 1998
|
|
47
|
Vera: an extensible router architecture
– Karlin, Peterson
- 1999
|
|
41
|
Opal: A single address space system for 64-bitarchitectures
– Chase, Levy, et al.
- 1993
|
|
40
|
A Secure Plan
– Hicks
- 1999
|
|
38
|
Smart packets: Applying active networks to network management
– Schwartz, Jackson, et al.
- 2000
|
|
33
|
The Price of Safety in an Active Network
– Alexander, Menage, et al.
- 2001
|
|
25
|
An active network approach for efficient network management
– Raz, Shavitt
- 1999
|
|
22
|
Anonymous RPC: Low-latency protection in a 64-bit address space, in
– Yarvin, Bukowski, et al.
- 1993
|
|
15
|
FIRE: Flexible intra-AS routing environment
– Partridge, Snoeren, et al.
- 2000
|
|
14
|
Effective Traffic Measurement Using ntop
– Deri, Suin
- 2000
|
|
14
|
A Defense Against Address Spoofing Using Active Networks
– Van
- 1997
|
|
13
|
The spread of the code-red worm (crv2
– Moore
- 2001
|
|
13
|
A Proposal to add Explicit Congestion Notification
– Ramakrishnan, Floyd
- 1999
|
|
12
|
An ECN-based end-to-end congestion-control framework: experiments and evaluation
– Laevens, Key, et al.
- 2000
|
|
9
|
Advanced and authenticated techniques for ip traceback
– Song, Perrig
- 2001
|
|
7
|
Scalable resource control in active networks
– Anagnostakis, Hicks, et al.
- 2000
|
|
6
|
Pushback messages for controlling aggregates in the network. Internet Draft, work in progress
– Floyd, Bellovin, et al.
|
|
4
|
NetFlow services and applications
– Corporation
- 2000
|
|
3
|
An Extensible Open Router Platform. http://www.xorp.org
– XORP
- 2001
|
|
3
|
Practical network applications on a leightweight active management environment
– Anagnostakis, Ioannidis, et al.
- 2001
|
|
2
|
Philippe Owezarski, Dina Papagiannaki, and Fouad Tobagi. Design and Deployment of a Passive Monitoring Infrastructure
– Fraleigh, Diot, et al.
- 2001
|
|
2
|
CERT Advisory CA-1996-21: TCP SYN Flooding and IP Spoofing Attacks
– Pages
- 1996
|
|
1
|
The shockwave rider. This is the original reference for the term "tape-worm
– Brunner
- 1975
|
|
1
|
Morrisett et al. Cyclone: A next-generation systems language
– Greg
- 2001
|
|
