Robust network monitoring in the presence of non-cooperative traffic queries

Abstract

We present the design of a predictive load shedding scheme for a network monitoring platform that supports multiple and competing traffic queries. The proposed scheme can anticipate overload situations and minimize their impact on the accuracy of the traffic queries. The main novelty of our approach is that it considers queries as black boxes, with arbitrary (and highly variable) input traffic and processing cost. Our system only requires a high-level specification of the accuracy requirements of each query to guide the load shedding procedure and assures a fair allocation of computing resources to queries in a non-cooperative environment. We present an implementation of our load shedding scheme in an existing network monitoring system and evaluate it with a diverse set of traffic queries. Our results show that, with the load shedding mechanism in place, the monitoring system can preserve the accuracy of the queries within predefined error bounds even during extreme overload conditions.

Introduction

The ability to extract detailed information from live traffic streams is critical to network management applications such as traffic engineering, performance analysis and network security. The challenges in this context include the unpredictable nature of network traffic as well as the types of computations, usually unknown in advance, to be performed on the packet streams. At any given point in time, a variable number of applications may need access to the packet stream traversing the same monitoring system.

Recently, several research efforts have proposed network monitoring frameworks that abstract away the low-level details of the network traffic and allow developers to quickly design and implement new methods to process and extract information from packet streams [7], [14]. These systems differ from previous designs in that they are not tailor made for a single specific application, but instead can handle multiple, concurrent monitoring applications.

In an environment where multiple monitoring applications compete for the same shared resources, ensuring fairness of service in the presence of overload is a basic requirement. Load shedding has been recently proposed as an effective alternative to over-provisioning for handling overload situations in several real-time systems [23], [20], [25], [3]. Load shedding is the process of dropping excess load in such a way that the system remains stable and no overflow occurs in the system buffers. Traditionally, load shedding has been implemented by dynamically discarding part of the incoming data in the presence of overload. In this work, we address the problem of how to efficiently and fairly shed excess load from an arbitrary set of monitoring applications while keeping the measurement error within bounds defined by the end users.

There are three main requirements that make this problem particularly challenging. First, the system operates in real-time with live packet streams. Therefore, the load shedding scheme must be lightweight and quickly adapt to sudden overload situations to prevent undesired packet losses. Second, the monitoring applications are unaware of other applications running on the same system and cannot be assumed to behave in a cooperative fashion. Instead, they will always try to obtain the maximum share of the system resources. The system however must ensure fairness of service and avoid starvation of any application, while trying to satisfy their accuracy requirements. Third, to provide developers with maximum flexibility, the system has to support arbitrary monitoring applications for which the resource demands are unknown a priori. In addition, the input data (i.e., the network traffic) is continuous, highly variable and unpredictable in nature. As a consequence, the system cannot make any assumptions about the input traffic nor use any explicit knowledge of the cost of the monitoring applications to decide, for example, when it is the right time to shed load.

To address this third challenge, in a previous work [3] we designed a load shedding scheme that can efficiently handle extreme overload situations, without requiring explicit knowledge of the monitoring applications. The core of our load shedding scheme is based on an on-line prediction model that allows the monitoring system to anticipate future overload situations. It infers the cost of each application from the relationship between its actual resource usage and a large set of simple (and lightweight) traffic features that summarize the incoming traffic (e.g., the number of packets, flows, unique IP destination addresses, etc.). This prediction is then used for gracefully degrading the accuracy of the monitoring applications by deciding, for example, when or how much load to shed using well-known traffic sampling techniques.

In this paper, we extend our previous load shedding scheme to address the problem of where to shed excess load (i.e., the amount of load to be shed in each application), which ensures robustness and fairness of service when dealing with non-cooperative monitoring applications.

In our previous prototype [3], an equal sampling rate is applied to each monitoring application in the presence of overload. Although this solution is fair in the number of packets processed by each application, this paper shows that the system can shed load more effectively by applying different sampling rates to different applications according to external information about their accuracy requirements (e.g., maximum loss the application can tolerate to guarantee a maximum error in the results).

Other strategies used by similar systems to decide where to shed load fall into two broad categories. The first includes solutions that maximize an aggregate performance metric, such as the overall system utility [23] or throughput [1], [22]. We argue that these approaches, when applied to non-cooperative environments, suffer from serious fairness issues and therefore are only suitable for scenarios where the system administrator has complete control over the utility functions or priorities of each application. In this paper, we propose instead a variant of the classical max–min fair share policy that ensures fairness of service even with non-cooperative users. We model our system using game theory and show that it has a single Nash equilibrium when all players provide correct information about their resource requirements. That is, our system has the appealing feature that a user obtains maximum benefit only when providing correct information to the system.

The second category includes solutions that achieve fairness of service by assuring that each application receives an equal share of the system computing resources [16]. In contrast, in this paper we show that, in the context of network monitoring, ensuring fair access to the packet stream can significantly improve the accuracy of monitoring applications. This result indicates that in a scenario where multiple monitoring applications have to run on the same system, a packet-based scheduler can obtain better performance than the Operating System task scheduler, which is basically designed to guarantee fair access to the CPU.

The remainder of this paper is organized as follows. The next two sections review the related work and our load shedding scheme, respectively. We present our method to handle non-cooperative monitoring applications in Section 4 and model it using game theory in Section 5. Section 6 describes our testbed scenario, while Section 7 presents a performance evaluation of an actual implementation. Finally, Section 8 concludes the paper and discusses future work.