Abstract

There is an increasing interest in passive monitoring of IP flows at multiple locations within an IP network. The objective of such a distributed monitoring system is to sample packets belonging to a large fraction of IP flows in a cost-effective manner by carefully placing monitors and controlling their sampling rates. In this paper, we consider the problem of where to place monitors within the network and how to control their sampling. To address the tradeoff between monitoring cost and monitoring coverage, we propose and study minimum cost and maximum coverage problems under various budget constraints and in the presence of routing changes caused by link failures. We show that all of the problem formulations are NP-hard. We propose greedy heuristics, and show that the heuristics provide solutions quite close to the optimal solutions through experiments using synthetic and real network topologies. In addition, our experiments show that a small number of monitors often suffices to monitor most of the traffic in an entire IP network.

Keywords: Network monitoring; Mathematical programming/optimization; Approximation algorithms; Set cover problem; Maximum coverage problem; Minimum cost problem; Packet sampling

Article Outline

1. Introduction

2. Problem setting

3. A set of passive monitoring problems without sampling

3.1. Budget constrained maximum coverage problem without sampling (BCMCP)

3.2. Minimum deployment cost problem without sampling (MDCP)

3.3. Minimum deployment and operating cost problem without sampling (MDOCP)

4. A passive monitoring problem with sampling

5. Evaluation of greedy heuristics, coverage, and marginal gain with additional monitoring points

5.1. Simulation parameter settings

5.1.1. Network topology, traffic matrix, and routing settings

5.1.2. Utility functions and cost assignment

5.2. Simulation results of BCMCP

5.3. Simulation results for BCMCP-S

6. Discussion and extensions

7. Related work

7.1. Number and location of tracers in the Internet

7.2. High coverage power with a small number of passive monitoring/filtering locations

7.3. Network tomography

7.4. Sampling strategies

8. Conclusion

Acknowledgements

Appendix A. Appendix

A.1. The hardness of the BCMCP problem

References