# FANT: Flexible Attention-Shifting Network Telemetry
## 5 Attention-Switching Strategy
### Implementation
Next, we discuss the basic performance of FANT. Finally, we explore the impact of different parameter configurations on FANT. #### 6.4.1 Use Case

In the prototype, we generate a 5 MB/s business flow (IPv4 TCP) on host 6 and direct this flow along a predetermined path (marked in red) to host 9 by configuring an SR-Policy on switch 15 at time 2. This setup is being used to implement a use case that mimics a scenario where a new network rule is applied to manage business traffic. We then check the monitoring results of the Network Application along the path. For simplicity, we only display the monitoring result of the port on switch 7 that connects to switch 15, as shown in Figure 6. From the Network Verification application supported by INT-P, an increase in traffic is detected in the application's port statistics (Egress Interface Tx Utilization), segment routing statistics (SR Byte count), and IPv4 statistics (IPv4 Byte Count) at port 5. Similarly, the Network Verification application supported by FANT-H also detects

Figure 5: Experiment topology (a 4-pod Fat-Tree) using FANT prototype. an increase in traffic in port statistics (Egress Interface Tx Utilization), segment routing statistics (SR Byte count), and IPv4 statistics (IPv4 Byte Count) at port 5. We observe that FANT has a minimal impact on ANT network applications, which focus on monitoring the sustained, comprehensive network-wide status. #### 6.4.2 Basic Performance

In actual network deployments, the number of suspicious links detected in each monitoring cycle should be low; hence, we set the anomaly rate at 3%. **Performance Across Different Sizes or Topologies**: As shown in Figure 7a, within a topology consisting of 1125 switches, INT-Probe consumed 4.7 MBps of bandwidth, while FANT-G and FANT-H utilized 3.2 MBps and 2.0 MBps (only 42.6% of INT-P), respectively. This result indicates that FANT introduces the least overhead compared to other approaches. As the network scale increases from 125 to 1125 switches, we observe that the bandwidth difference between FANT-H and INT-P grows from 0.12 MBps to 2.0 MBps, which is larger

Figure 6: Functional verification of network applications based on the prototype. (**a**) INT-P-based Network Verification application. (**b**) FANT-based Network Verification application. than the bandwidth difference between FANT-G and INT-P. This highlights the efficiency of our heuristic algorithm. Figure 7: Performance and execution time of three methods across various sizes of spine-leaf topology. (**a**) Bandwidth consumption. (**b**) Normalized bandwidth consumption. (**c**) Strategy’s execution time. Figures 7a and 8a illustrate that the bandwidth usage in spine-leaf topologies is higher than in fat-tree topologies. This is because spine-leaf topologies have more links for the same number of switches, which consequently enlarges the algorithm input (\(R\) and \(P\)). We normalize the overhead of each method based on the bandwidth usage of INT-Probe, as depicted in Figures 7b and 8b. The normalized bandwidth of FANT-H remains stable when number of switches increase, demonstrating that the FANT-H strategy effectively reduces bandwidth across various network sizes. Additionally, in spine-leaf topologies, both FANT-H and FANT-G exhibit lower normalized bandwidth than in fat-tree topologies, indicating that our approach performs better in topologies with stronger connectivity. Figure 7c shows that without configured acceleration factors, the algorithm's execution time almost reaches \(10^{2}\) s in topologies with more than \(10^{3}\) switches, significantly exceeding the measurement cycle (i.e., one second). This delay impacts the normal functioning of attention-switching strategies. FANT employs two methods to address this issue: (i.) Enhance the script's execution speed: FANT can improve execution efficiency by converting the logic implemented in Python to C++ using PyPy (using PyPy, we only need 10 s with 1125 switches) or by multithreading the program. (ii.)