# FANT: Flexible Attention-Shifting Network Telemetry
## 5 Attention-Switching Strategy
### Implementation
Specifically, we invoke the INT-Probe method twice with two independent sets \(S\) to generate two mutually independent path traces. We then output the union of these path traces as the output of the enhanced algorithm. For simplicity, we refer to the enhanced INT-Probe algorithm for probe generation as EINP. We extended the metrics in the INT specification [10] and established 15 measurement metrics as the comprehensive set supported for monitoring by FANT, as detailed in Table 2. We employ a Metrics Categorization Strategy to classify these metrics. The metric marked by an asterisk in Table 2 is categorized as a basic measurement by the Metrics Categorization Strategy. Consequently, the instruction bitmap for basic measurements is 0 xF161, and the instruction bitmap for detailed measurements is 0 xFFFF. Unless otherwise stated, the attention-switching strategy is configured to operate with the acceleration factors set as \(a_{1}=0\) and \(a_{2}=0\). **Prototype:** We deployed our FANT prototype in a 4-pod fat-tree topology as shown in Figure 5. We assigned identifiers 1-16 to the hosts connected to the Top-of-Rack (TOR) switches from left to right. We designated hosts 1 and 5 as the first set of probe generators/collectors and hosts 8 and 9 as the second set of probe generators/collectors. If the value of any result in this measurement cycle is more than twice the value from the previous cycle, we identify the links associated with that result as suspicious. Each host is instructed \begin{table}
\begin{tabular}{c l} \hline \hline
**Position (bit)** & **Description and Width (bits)** \\ \hline
0 * & Node ID (32 bits) \\
1 * & Level 1 Ingress Interface ID (16 bits) + Egress Interface ID (16 bits) \\
2 * & Hop latency (32 bits) \\
3 * & Queue ID (8 bits) + Queue occupancy (24 bits) \\
4 & Ingress timestamp (64 bits) \\
5 & Egress timestamp (64 bits) \\
6 & Level 2 Ingress Interface ID (32 bits) + Egress Interface ID (32 bits) \\
7 * & Egress interface Tx utilization (32 bits) \\
8 & Buffer ID (8 bits) + Buffer occupancy (24 bits) \\
9 * & Egress Interface Tx packets count (32 bits) \\
10 * & Drop packets count (32 bits) \\
11 & Drop bytes count (32 bits) \\
12 & Segment Routing packets count (32 bits) + bytes count (32 bits) \\
13 & IPv4 packets count (32 bits) + bytes count (32 bits) \\
14 & IPv6 packets count (32 bits) + bytes count (32 bits) \\
15 * & Checksum Complement \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Metrics and corresponding instruction bitmap field values in experiments. to send traffic at a rate of 71 KB/s to all other hosts, resulting in a background traffic rate of 1 MB/s at all links. **Large Scale Simulation:** We utilize topology generation methods to create diverse network topologies, including various sizes (detailed in the figure axis) of fat-tree or spine-leaf (the spine-leaf topology in our experiment, specified with a total number of switches \(n\), consists of \(\frac{1}{3}*n\) switches in the spine layer and \(\frac{2}{3}*n\) switches in the leaf layer. Each switch in the spine layer is interconnected with every switch in the leaf layer, and there are no connections between switches within the same layer). We set \(|S|\) as 10% of the total number of hosts. We randomly select \(|S|\) hosts to form the first set of probe generators/collectors, and then randomly select another \(|S|\) hosts that do not overlap with the first set to form the second set of probe generators/collectors. Based on topology and two distinct \(S\), we use the EINP to get \(P\). In subsequent performance evaluations, we set the abnormal rate at \(x\%\). This means that in each measurement cycle, \(x\%\) of all links are randomly chosen as the suspicion area \(R\). To minimize the impact of randomness, the results of the experiment are averaged over 100 cycles. Based on \(P\) and \(R\), we invoke FANT-H and FANT-G to obtain the performance and time consumption. ### Experimental Result

In this section, we first present a use case of a network application supported by FANT.