# SmartX Multi-View Visibility Framework
## 4 SmartX MVF with Flow-Centric Visibility: Verification
### Network Packets Flow Classification and Visualization Results  
Integrated network packets flow classification is verified by conducting various experiments. For this purpose, we selected three tenants (i.e., demo, ncku, and uscm) to generate network traffic by using various TCP/UDP application ports. As shown in Table 1, four cases are verified by generating traffic that is associated with various classes to ensure implemented non-learning-based classification is working as expected. We understand that assuming the server port always identifies an application is not fully correct. However, we assume the ports used in this work belong to the expected applications. Furthermore, we also do not consider traffic of the selected applications on other than the standard server ports e.g., HTTP traffic is on port 80 but not on port 81. Figure 13a shows the result for network packets flows that are classified as identified. In this pie chart, the innermost ring shows the TEIN PoPs (point-of-presence) (TEINHK and TEINSG) from where network packets have passed. The second ring shows the site names (e.g., VN-HUST) from where identified network packets flows are collected and third ring shows the tenant names (e.g., demo). The fourth ring shows the OpenStack VM instance names (e.g., USCM-myren-vm) from where network packets flow is initiated or terminated. The outermost ring shows the application names (e.g., InfluxDB). We can see all the applications, which were listed as identified in Table 1, are also classified as identified by the system and properly tagged with corresponding tenant and application names. For example, port 9092 corresponded to the Kafka and belonged to the demo tenant, and port 8086 corresponded to the InfluxDB and belonged to the uscm tenant. Figure 13b shows the result for network packet flow that were classified as known. In this pie chart, the innermost ring shows the TEIN PoPs. The second ring shows the site names and third ring shows the tenant names. The outermost ring shows the application ports (7000, 8000, and 1250). Please note these snapshots were taken from the real system and can easily incorporate further rings to display more information as well as show the tooltip with corresponding and associated ring's actual values from the data. Figure 13c shows the result for network packets flows that are classified as unknown. In this pie chart, the innermost ring shows the TEIN PoPs. The second ring shows the SmartX boxes names (e.g., SmartX-Box-GIST1) from where unknown network packets were collected and the third ring shows the IP addresses (e.g., 6.2.0.120). The outermost ring shows the application port numbers (e.g., 1285) from where network packets are originated. Interestingly, we did not generate any traffic for unknown class and still got packets classified into this class. Upon further investigation, ONOS SDN controller application \begin{table}
\begin{tabular}{c c c c} \hline \hline  & **Demo** & **Uscm** & **Ncku** \\ \hline Case I & Identified (9092) & Identified (11,211) & Identified (6343) \\ Case II & Identified (53) & Attack (27,017) & Identified (161) \\ Case III & Attack (443) & Identified (8086) & Known (1250) \\ Case IV & Known (8000) & Known (7000) & Attack (11,211) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Verification cases of network packets flow classification for three different tenants. Figure 12: Flow-centric visibility verification results. (**a**) The number of visibility data instances collected for a month and (**b**) execution time of visibility integration component. was found to be using this port number and IP addresses. Figure 13d shows the result for network packets flows that are classified as an attack. In this pie chart, the innermost ring shows the TEIN PoPs. The second ring shows the national research and education network names (e.g., TWAREN) and third ring shows the tenant names. The outermost ring shows the OpenStack VM instance IP addresses (e.g., 192.168.1.124).