Home > Topics > Passive Monitoring > Load management in network monitoring > Traditional approaches

Traditional approaches

In network monitoring, the simplest form of overload management consists of discarding packets without control in the presence of overload. This naive approach is still adopted by most monitoring applications, although it is known to have a severe (and unpredictable) impact on the accuracy and effectiveness of these applications.

In order to minimize this impact, critical monitoring systems often integrate specialized hardware (e.g., DAG cards, SCAMPI adapters, router add-ons, network processors [Wolf et al., 2006] or make use of ad-hoc configurations (e.g. [Schneider et al., 2007]) to avoid the inherent hardware limitations of the PC-based architecture for network monitoring [Iannaccone et al., 2001],  [Agarwal et al., 2003]. Although these solutions have demonstrated their effectiveness in some scenarios, they present scalability issues that make them viable only as a short-term solution.

Other monitoring systems have opted to significantly reduce their online functionalities in order to operate in high-speed environments (e.g., OC3MON [Apisdorf et al., 1996], Sprint IPMON [Fraleigh et al., 2003]). In this case, complex traffic analysis computations are postponed to an offline stage.

References

  • [conf-lisa-ApisdorfCTW96] bibtex
    J. Apisdorf, K. C. Claffy, K. Thompson, and R. Wilder, "OC3MON: Flexible, Affordable, High Performance Staistics Collection.," in LISA, 2004-10-26 1996, pp. 97-112.
    @inproceedings{conf/lisa/ApisdorfCTW96,
      author = {Joel Apisdorf and Kimberly C. Claffy and Kevin Thompson and Rick Wilder},
      booktitle = {LISA},
      crossref = {conf/lisa/1996},
      interhash = {d5e9a69e781a9f864a579a94d2da6cb7},
      intrahash = {ada7208febc6fc6e851edb3aa16f4771},
      pages = {97-112},
      publisher = {USENIX},
      title = {OC3MON: Flexible, Affordable, High Performance Staistics Collection.},
      url = {http://dblp.uni-trier.de/db/conf/lisa/lisa1996.html#ApisdorfCTW96},
      year = 1996, keywords = {dblp},
      ee = {http://www.usenix.org/publications/library/proceedings/lisa96/kc.html},
      added-at = {2004-10-26T00:00:00.000+0200},
      description = {dblp},
      isbn = {1-880446-81-2},
      biburl = {http://www.bibsonomy.org/bibtex/2ada7208febc6fc6e851edb3aa16f4771/dblp},
      date = {2004-10-26}
    }
  • [conf-imw-IannacconeDGM01] bibtex
    G. Iannaccone, C. Diot, I. Graham, and N. McKeown, "Monitoring very high speed links.," in Internet Measurement Workshop, 2005-02-24 2001, pp. 267-271.
    @inproceedings{conf/imw/IannacconeDGM01,
      author = {Gianluca Iannaccone and Christophe Diot and Ian Graham and Nick McKeown},
      booktitle = {Internet Measurement Workshop},
      crossref = {conf/imw/2001},
      editor = {Vern Paxson},
      interhash = {60a8fdee30beb5d7737cc1f48340b1d9},
      intrahash = {fe2c8cec163470b55000eab39bc535e8},
      pages = {267-271},
      publisher = {ACM},
      title = {Monitoring very high speed links.},
      url = {http://dblp.uni-trier.de/db/conf/imw/imw2001.html#IannacconeDGM01},
      year = 2001, keywords = {dblp},
      ee = {http://doi.acm.org/10.1145/505202.505235},
      added-at = {2005-02-24T00:00:00.000+0100},
      description = {dblp},
      isbn = {1-58113-435-5},
      biburl = {http://www.bibsonomy.org/bibtex/2fe2c8cec163470b55000eab39bc535e8/dblp},
      date = {2005-02-24}
    }
  • [conf-pam-SchneiderWF07] bibtex
    F. Schneider, J. Wallerich, and A. Feldmann, "Packet Capture in 10-Gigabit Ethernet Environments Using Contemporary Commodity Hardware.," in PAM, 2007-07-10 2007, pp. 207-217.
    @inproceedings{conf/pam/SchneiderWF07,
      author = {Fabian Schneider and Jörg Wallerich and Anja Feldmann},
      booktitle = {PAM},
      crossref = {conf/pam/2007},
      editor = {Steve Uhlig and Konstantina Papagiannaki and Olivier Bonaventure},
      interhash = {97e389d7d23c07c9201370fab1ed77b7},
      intrahash = {0f1598aff25f4f343caff751b18498b6},
      pages = {207-217},
      publisher = {Springer},
      series = {Lecture Notes in Computer Science},
      title = {Packet Capture in 10-Gigabit Ethernet Environments Using Contemporary Commodity Hardware.},
      url = {http://dblp.uni-trier.de/db/conf/pam/pam2007.html#SchneiderWF07},
      volume = 4427, year = 2007, keywords = {dblp},
      ee = {http://dx.doi.org/10.1007/978-3-540-71617-4_21},
      added-at = {2007-07-10T00:00:00.000+0200},
      description = {dblp},
      isbn = {978-3-540-71616-7},
      biburl = {http://www.bibsonomy.org/bibtex/20f1598aff25f4f343caff751b18498b6/dblp},
      date = {2007-07-10}
    }
  • [conf-mascots-WolfRBY06] bibtex
    T. Wolf, R. Ramaswamy, S. Bung, and N. Yang, "An Architecture for Distributed Real-Time Passive Network Measurement.," in MASCOTS, 2007-01-05 2006, pp. 335-344.
    @inproceedings{conf/mascots/WolfRBY06,
      author = {Tilman Wolf and Ramaswamy Ramaswamy and Siddhartha Bung and Ning Yang},
      booktitle = {MASCOTS},
      crossref = {conf/mascots/2006},
      interhash = {90ea80cd8f9be575e4d1c1ab6ea0047d},
      intrahash = {3e8ccefe7f59b15e929aa3a017fe05b2},
      pages = {335-344},
      publisher = {IEEE Computer Society},
      title = {An Architecture for Distributed Real-Time Passive Network Measurement.},
      url = {http://dblp.uni-trier.de/db/conf/mascots/mascots2006.html#WolfRBY06},
      year = 2006, keywords = {dblp},
      ee = {http://doi.ieeecomputersociety.org/10.1109/MASCOTS.2006.11},
      added-at = {2007-01-05T00:00:00.000+0100},
      description = {dblp},
      isbn = {0-7695-2573-3},
      biburl = {http://www.bibsonomy.org/bibtex/23e8ccefe7f59b15e929aa3a017fe05b2/dblp},
      date = {2007-01-05}
    }
  • D. Agarwal, J. M. González, G. Jin and B. Tierney. An Infrastructure for Passive Network Monitoring of Application Data Streams. In Proc. of Passive and Active Measurement Conf., 2003
  • C. Fraleigh, S. Moon, B. Lyles, C. Cotton, M. Khan, D. Moll, R. Rockell, T. Seely and C. Diot. Packet-level traffic measurements from the Sprint IP backbone. IEEE Network, 2003.