A Theoretical Framework for Network Monitoring Exploiting Segment Routing Counters

Abstract

Self-driving networks represent the next step of network management techniques in the close future. A fundamental point for such an evolution is the use of Machine Learning based solutions to extract information from data coming from network devices during their activity. In this work we focus on a new type of data, available thanks to the definition of the novel SRv6 paradigm, referred to as SRv6 Traffic Counters (SRTCs). SRTCs provide aggregated measurements related to forwarding operations performed by SRv6 routers. In this work a detailed description of different SRTCs types (SR.INT, PISD, PSID.TM and POL) is provided and their relationships is formalized. The theoretical framework deployed is used to identify, on the basis of network configuration parameters of both SRv6 and IGP protocols, the minimum set of independent SRTCs to characterize the Network Status: we show that about the 80% of counters can be neglected with no information loss. We also apply our framework to two use cases: i) Traffic Matrix (TM) Assessment and ii) Traffic Anomaly Detection. For the TM assessment, we show that in a partially deployed SRv6 scenario a specific type of SRTCs, i.e., PSID, is more reliable than other ones; on the contrary, in a fully deployed scenario POL and PSID.TM counters provide the full TM knowledge. For the Traffic Anomaly Detection case, we show that known solutions based on link load measurements can be improved when integrating SRTCs information.

Investigating on Black Holes in Segment Routing Networks: Identification and Detection

“…Exploiting this model, the Authors show SRTCs can successfully used to improve the performance of existing algorithms in different networking problems (e.g, Traffic Matrix Assessment, Traffic Anomaly Detection, etc.). The present paper is strongly based on the findings reported in [21].…”

“…Finally, POL counters keep track of the amount of traffic that has been steered through a specific SR policy. These counters are described in detail in [21], where the logical relations between them are captured by a mathematical model. Exploiting this model, the Authors show SRTCs can successfully used to improve the performance of existing algorithms in different networking problems (e.g, Traffic Matrix Assessment, Traffic Anomaly Detection, etc.).…”

“…The first one is named link count, y L (l), and accounts the amount of traffic (expressed in number of bytes) transmitted over the link l. The collection of all the link counts is represented by the vector y L . Furthermore, Prefix Segment IDentifiers (PSID) and POLicy (POL) counters [21] are used to get statistics on the SR traffic. The PSID counter instantiated at node i for the segment identifier a, referred to as y B (i, a), accounts all the packets received at node i having a as active segment.…”