DMCA
New Directions in Traffic Measurement and Accounting (2001)
| Citations: | 353 - 11 self |
BibTeX
@INPROCEEDINGS{Estan01newdirections,
author = {Cristian Estan and George Varghese},
title = {New Directions in Traffic Measurement and Accounting},
booktitle = {},
year = {2001},
pages = {75--80}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Accurate network traffic measurement is required for accounting, bandwidth provisioning, and detecting DOS attacks. However, keeping a counter to measure the traffic sent by each of a million concurrent flows is too expensive (using SRAM) or slow (using DRAM). The current state-of-the-art (e.g., Cisco NetFlow) methods which count periodically sampled packets are slow, inaccurate, and memory-intensive. Our paper introduces a paradigm shift by concentrating on the problem of measuring only "heavy" flows --- i.e., flows whose traffic is above some threshold such as 1% of the link. After showing that a number of simple solutions based on cached counters and classical sampling do not work, we describe two novel and scalable schemes for this purpose which take a constant number of memory references per packet and use a small amount of memory. Further, unlike NetFlow estimates, we have provable bounds on the accuracy of measured rates and the probability of false negatives. We also propose a new form of accounting called threshold accounting in which only flows above threshold are charged by usage while the rest are charged a fixed fee. Threshold accounting generalizes the familiar notions of usage-based and duration based pricing. I.
Keyphrases
traffic measurement new direction threshold accounting constant number paradigm shift small amount bandwidth provisioning concurrent flow new form current state-of-the-art memory reference simple solution netflow estimate scalable scheme accurate network traffic measurement fixed fee provable bound cisco netflow classical sampling familiar notion do attack false negative cached counter
