# FANT: Flexible Attention-Shifting Network Telemetry
## 3 FANT System
### Workflow  
For clarity, let us assume the system's initial measurement occurs at time \(t\), and subsequent measurements occur at time \(t+n*\delta t\) (FANT optimizes the existing AINT system, and thus \(\delta t\) is the same as the frequency of the AINT systems). The workflow of FANT is outlined as follows:  
A (not shown in the Figure 2). Prior to initiating measurements, FANT executes a metrics categorization strategy (Section 4), categorizing the measurement metrics into basic and detailed measurement metrics. Note that unlike FINT [18] and SFANT [19], which support multiple types of measurements to enhance flexibility, the FANT system only supports two types of measurements: basic and detailed. This approach reduces the hardware requirements [**R3.1**]. B. The INT controller activates an existing network-wide probe generation algorithm to create a set of probes for basic network-wide measurement [**R1.1**]. Note that the system supports any user-selected probe generation algorithm for probe trace planning, thus maintaining the fundamental characteristics of the original solutions. For example, the INT-Probe algorithm can achieve theoretically optimal overhead; the INT balance algorithm can approximate the completion time for each probe's measurements; and traversing every link in the topology can enhance the system's robustness. C. The INT controller directs the probe generators/collectors to inject probes (for either detailed or basic measurements) into the data plane at time \(t\). When \(t\) is 0, all probes are set to perform basic measurements. These probes gather network status according to the planned traces and specified measurement instructions and then report back to the INT controller after being aggregated by the probe generators/collectors. D. The INT controller analyzes time \(t\)'s measurement results to determine which links require detailed measurements (suspicious links) and which require basic measurements (normal links) at time \(t+1*\delta t\). FANT analyzes suspicious links using historical absolute deviation and historical difference deviation (calculated based on the links metrics values from the last few cycles). Additional methods, such as AI-based techniques, can also be used to detect suspicious links. Since this is not the primary focus of FANT, it is not discussed here. Details on how to analyze suspicious links based on the measurement result and the complexity of the methods are provided in Appendix B.  
E. Based on the analysis of measurement needs from step D, the INT controller implements an attention-switching strategy (Section 5) to determine which basic measurement probes should switch to detailed measurement probes and which detailed measurement probes should switch to basic measurement probes at time \(t+1*\delta t\) [**R1.2 & R2.2**]. The results are then communicated to the INT-Probe generator/collector. F. The probe generators/collectors update the INT instructions for some probes to enable or disable detailed measurements, based on the probe-switching instructions received. At time \(t+1*\delta t\), both updated and unchanged probes are injected into the data plane [**R2.1**]. Note that FANT does not inject additional probes for detail measurements. This is because we prioritize ensuring that packets per second (pps) does not increase, before striving to reduce bits per second (pps) as much as possible. This approach is taken because the measurement system introduces both additional bps and pps, but typically, the impact of higher pps is more significant than the increase in bps in current data center networks due to two reasons: (i.) The chips within transmission devices (i.e., switches and network cards) process network traffic (i.e., forwarding, counting, querying, and queuing) on a per-packet basis. Consequently, the processing latency of these devices exhibits an inverse correlation with the increase in pps while showing no direct correlation with bps.