# FANT: Flexible Attention-Shifting Network Telemetry
## 5 Attention-Switching Strategy
### Implementation
To minimize overhead, FANT does not inject extra probe packets for measurement; instead, it reallocates attention by modifying the INT instructions of existing measurement probes. To optimize this shifting strategy, we model the problem as a weighted set cover problem. Considering that the model is NP-hard, we utilize a heuristic algorithm to address it. Our method surpasses the state-of-the-art solution by achieving bandwidth savings of 30% to 65%, and it can compute rapidly around \(10^{5}\times\) fast with 6.4% reduction in performance when configured with appropriate acceleration factors. **Author Contributions:** Conceptualization, M.C. ; methodology, M.C. ; software, M.C. and Y.P. ; validation, M.C. and Y.P. ; writing--original draft preparation, M.C. ; writing--review and editing, M.C. and F.Y. All authors have read and agreed to the published version of the manuscript. **Funding:** This research was funded by National Key Research and Development Project of China grant number 2020 YFB1804603. **In Institutional Review Board Statement:** Not applicable. **Informed Consent Statement:** Not applicable. **Data Availability Statement:** The original contributions presented in the study are included in the article; further inquiries can be directed to the corresponding author. **Acknowledgments:** All authors have read and agreed to the published version of the manuscript. **Conflicts of Interest:** The authors declare no conflicts of interest. The funders had no role in the design of the study; in the collection, analyses, or interpretation of data; in the writing of the manuscript; or in the decision to publish the results. ## Appendix A

Our investigation reveals that the telemetry supported by existing switch chips primarily follows three standards: IOAM [22], IFA [23], and INT specification [11]. FANT can be seamlessly integrated with some current switches, while others may require minor logic modifications. The IOAM standard allows for the insertion of a variable number of metrics. The metrics inserted into the telemetry result field are determined by the node length field and trace-type field. FANT's telemetry requirements can be met by utilizing different trace types to obtain basic measurement and detail measurement. standards. However, our method cannot yet be applied to switches that support telemetry based on the IFA (Broadcom switches supporting telemetry) standard. ## Appendix B

FANT identifies suspicious links by analyzing metrics from basic measurements that exhibit abnormal deviations from historical data. Links associated with any suspicious metrics are added to the set of suspicious links. Below, we detail the methods described in the main text for analyzing metric anomalies based on historical absolute deviation and historical difference deviation. For clarity, we introduce the following notation:

* \(m_{i}\): One of the metrics in the basic measurement metric set. * \(e_{j}\): A direct edge in the topology. * \(p_{h}\): One of the probe cycles in the set \(P\). * \(v_{i,j,h,t}\): The measurement result of metric \(m_{i}\), obtained by probe \(p_{h}\) on edge \(e_{j}\) at time \(t\). * \(threshold_{1}\) & \(threshold_{2}\): Two predefined thresholds. If the absolute change in a metric's measurement exceeds \(threshold_{1}\) or the rate of change surpasses \(threshold_{2}\), FANT considers this metric and its associated edge to be suspicious. FANT maintains two Redis lists for each \(<\!m_{i},e_{j},p_{l}\!>\) tuple:

\(List_{1}\) sequentially stores values from \(v_{i,j,h,(t_{start}+1\!+\!s_{fl})}\), \(v_{i,j,h,(t_{start}+2\!+\!s_{fl})}\),..., \(v_{i,j,h,(t_{start}+k\!+\!s_{fl})}\). \(List_{2}\) sequentially stores values from \(\delta v_{i,j,h,(t_{start}+1\!+\!s_{fl})}\),..., \(\delta v_{i,j,h,(t_{start}+(k-1)\!+\!s_{fl})}\).