New directions in traffic measurement and accounting

Measurement of various traffic aggregates is an indispensable tool of the operators of IP backbones. One of the obstacles t ha t prevents the use of measurement data for billing is its inaccuracy. The reason of this inaccuracy is how the measurement is done on high speed links: state of the art routers count only periodically sampled packets (e.g. Cisco's sampled NetFlow). On an OC-192 link , one has 32 nanoseconds to handle a 40 byte packet while access times to DKAMs are at least 50 nanoseconds. Previous work showed that at different granularities, a small number of "heavy hitters" accounts for a large share of the total tralilc. Our paper introduces a paradigm shift by concentrating the measurement efforts on only these large flows. By using smaller, faster memories we can measure them accurately. We propose two algorithms for identifying the large flows using little extra memory and a fixed small number of per packet memory accesses: sample and hold and multistage filter. We evaluate the algorithms analytically and on traces of actual traffic to show their accuracy and scalability. A flow is defined by a flow identifier (flow ID) tha t has to be contained in each packet belonging to a flow or be computable based on what the packet contains. Large flows are those tha t send more than a given threshold (say 1% of the link capacity) during a given measurement interval (1 second, 1 minute or even 1 hour). Ideally we would want our algorithm to give us at the end of the interval the list of the flow IDs of all the flows tha t exceeded the threshold and their exact size. Our algorithms work together with a small, fast flow memory. The number of active flows is significantly larger than the number of entries in the flow memory. At each packet arrival we can afford to look up a flow ID, update the counter(s) in the entry or allocate a new entry if there is no entry associated with the current packet. Ideally, the algorithms for identifying large flows would allocate an entry in the flow memory for each large flow and never allocate entries for flows below the threshold. After the entry is allocated, we exactly count the traffic of the flow it belongs to. Sample and hold has a very small probability of missing large flows by not adding them to the flow memory and multistage filter never misses one. Multistage filter provably adds very few small flows and we have bounds on the number of small flows added by sample and hold too. We report actual par.ket counts and therefore never overestimate the size of a flow. We underest imate it by the amount of traffic tha t passed by before the flow was added to the flow memory. Our estimates for the traffic of the identified large flows have smaller errors than those one can obtain from sampled NetFlow. Multistage filter is slightly more complex than sample and hold, but it uses less memory. A full description and analysis of the algorithms will be presented in the final paper which will be linked from http:/ /wtm-cse, ucsd. edu/users/varghe se/ . We envision many applications to our algorithms because they are quite generic. The flow identifier can be the 5-tuple of source IP address, destination IP address, protocol number, source port and destinat ion port. Or it can be the source network and the destination network, both of which can be computed through a lookup in the routing table. Alternately we can define the flow by only the destination IP address of the packets. Our algorithms can be used for real t ime traffic monitoring, detecting ongoing (distributed) denial of service attacks or billing. We propose scalable threshold accounting: accurately track the traffic tha t exceeds x% of the link, the customers exceeding the threshold are subject to usage based pricing while the others pay a fiat fee.