Managing and securing networks requires collecting and analyzing measurement data. Current technologies do not make it easy to do so, typically because they separate data collection (e.g., packet capture or flow monitoring) from analysis, producing either too much data to answer a general question, or too little data to answer a detailed question. This paper presents Sonata, a network telemetry system that exposes a query interface that directs the joint collection and analysis of network traffic. Sonata allows operators to directly express queries in a highlevel language, partitions each query into a portion that runs on the switch and another that runs on the streaming analytics platform, and refines the query to capture only the traffic that satisfies a query. Sonata allows operators to express real network monitoring tasks using dataflow operators, a compact, familiar programming idiom. Evaluation using traffic traces from a large ISP backbone show that Sonata's ability to compile portions of these queries to the data plane can reduce traffic rates at the stream processor by up to seven orders of magnitude.
A work more related to our context is Sonata REF , a system that coordinates the collection and analysis of network traffic to answer operator-defined monitoring queries.
Sonata: query-driven streaming network telemetry
SIGCOMM '18
Computer Science