Information Elements for Data Link Layer Traffic Measurement

Aitken, Paul; Kashima, Shingo; Kobayashi, Akito

doi:10.17487/rfc7133

Cited by 3 publications

(3 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Representative technologies for total traffic monitoring include the classical pull-type simple network management protocol (SNMP) [8] and the recently introduced push-type network telemetry [9]. End-end traffic monitoring can be classified into a flow measurement approach [1,2,10,11] and a detailed packet capturing approach called deep packet inspection (DPI) [12]. We focus on the flow measurement approach because the granularity of information obtained from the overall traffic monitoring is too coarse, whereas that of the DPI is detailed; however, too much information is expensive to manage.…”

Section: Related Workmentioning

confidence: 99%

Spatial Anomaly Detection Using Fast xFlow Proxy for Nation-Wide IP Network

Kamamura,

Hayashi,

Fujiwara

2024

IEICE Trans. Commun.

View full text Add to dashboard Cite

This paper proposes an anomaly-detection method using the Fast xFlow Proxy, which enables fine-grained measurement of communication traffic. When a fault occurs in services or networks, communication traffic changes from its normal behavior. Therefore, anomalies can be detected by analyzing their autocorrelations. However, in large-scale carrier networks, packets are generally encapsulated and observed as aggregate values, making it difficult to detect minute changes in individual communication flows. Therefore, we developed the Fast xFlow Proxy, which analyzes encapsulated packets in real time and enables flows to be measured at an arbitrary granularity. In this paper, we propose an algorithm that utilizes the Fast xFlow Proxy to detect not only the anomaly occurrence but also its cause, that is, the location of the fault at the end-to-end. The idea is not only to analyze the autocorrelation of a specific flow but also to apply spatial analysis to estimate the fault location by comparing the behavior of multiple flows. Through extensive simulations, we demonstrate that base station, network, and service faults can be detected without any false negative detections.

show abstract

Section: Related Workmentioning

confidence: 99%

Spatial Anomaly Detection Using Fast xFlow Proxy for Nation-Wide IP Network

Kamamura,

Hayashi,

Fujiwara

2024

IEICE Trans. Commun.

View full text Add to dashboard Cite

show abstract

“…For (i), traffic monitoring technologies are mainly classified into link-by-link traffic monitoring with the simple network management protocol [18] or network telemetry [19,20] and flow monitoring with xFlow technologies [21][22][23][24][25][26][27][28][29][30]. Link-by-link monitoring obtains the value of interface counters in a router, whereas flow monitoring computes statistics of flows using the sampling [21][22][23][24] or probabilistic data structure [25][26][27][28][29][30].…”

Section: Related Workmentioning

confidence: 99%

“…The xFlow technology monitors end-to-end traffic and is comprised of two methods: flow statistics approaches, such as NetFlow [21] and IPFIX [22], and header sampling approaches, such as sFlow [23] and IPFIX IE315 [24]. A flow is defined as a set of IP packets passing an observation point in the network during a certain time interval, such that all packets belonging to a particular flow have a set of common properties [22].…”

Section: Related Workmentioning

confidence: 99%

Dynamic Traffic Engineering Considering Service Grade in Integrated Service Network

Kamamura

2022

IEEE Access

View full text Add to dashboard Cite

This study proposes a dynamic traffic engineering method to improve network resource utilization efficiency without affecting important services in an integrated service network where multiple grades of service are accommodated. Network resource utilization is biased over time because future fluctuations in traffic demand are unpredictable. Although a service network provider prefers to re-optimize network resource utilization using a dynamic traffic engineering, it is often superfluous for users who do not want their mission-critical communications, for example, executive web meetings or online surgery, to be affected. Therefore, we classified traffic into very important packets and commoners, and only commoners were dynamically optimized. To classify traffic, we assigned the identifier to a packet on the application side. In this approach, only the application and edge nodes of the network required modification; the core network routers were unaffected. Furthermore, we established the architecture of the edge node using a software-defined network controller and P4 switch. We also provided an algorithm for optimization based on linear programming and demonstrated that it is possible to improve network resource utilization efficiency without affecting very important packets and that the computational and memory costs are practical.

show abstract