| Network monitoring serves as basis for a wide scope of network operation, engineering and management. Precise network monitoring involves inspecting every packet traversing in a network. However, it is infeasible in today's and future high-speed networks, due to significant overheads of processing, storing, and transferring measured data. Therefore, scalable network monitoring techniques are in urgent need. This thesis addresses the scalability issue of network monitoring from both traffic and performance perspectives.; On scalable traffic monitoring, we propose sampling techniques for total load and flow measurement. In order to develop accurate and efficient measurement schemes, we study various aspects of traffic characteristics and their impacts on packet sampling. We find that static sampling does not adjust itself to dynamic traffic conditions, yielding often erroneous estimations or excessive oversampling. We develop the adaptive random sampling technique for total load estimation, that determines the sampling probability adaptively according to traffic condition. Then, we enhance the adaptive sampling technique to measure traffic in flow level. Flow measurement is a particularly challenging problem, since flows arrive at random time, stay for random duration, and their rates fluctuate over time. Those characteristics make it hard to decide a sampling interval where sampling probability is adapted, and to define a large flow pragmatically. Through a stratified approach, we estimate large flows accurately, regardless of their arrival times, durations, and rate variabilities during their life times.; On practical performance monitoring, we investigate issues around network delay. We first perform a detailed analysis of point-to-point packet delay in an operational tier-1 network. Through a systematic methodology and careful analysis, we identify the major factors that contribute to point-to-point delay, and characterize their effect on the network delay performance. Next, we identify high quantile as a meaningful metric in summarizing a delay distribution. Then, we propose an active sampling scheme to estimate a high quantile of a delay distribution with bounded error. We finally show that active probing is the most scalable approach to delay measurement. The validation of our proposed schemes and analysis of network traffic and performance presented in this thesis are conducted with real operational network traces. |
