Device, method and system for distributed network flow monitoring

Abstract

The present disclosure relates to network flow monitoring. A controller is configured to obtain flow information on a plurality of flows from a plurality of network entities (transmitting the flows) during a first measurement epoch, and perform sketch assignment among the plurality of network entities for a second measurement epoch subsequent to the first epoch based on the obtained flow information. For performing the sketch assignment, the controller determines whether each network entity is configured to monitor a corresponding flow using a sketch or to ignore at least a part of the corresponding flow. Optionally, before sketch assignment, the controller may also perform traffic prediction for improving the sketch assignment. The sketch assignment of this disclosure is updated for each measurement epoch actively and dynamically. In this way, the flow monitoring accuracy can be improved.

Description

[0001] DEVICE, METHOD AND SYSTEM FOR DISTRIBUTED NETWORK FLOW MONITORING

[0002] TECHNICAL FIELD

[0003] The present disclosure generally relates to the field of networking. For instance, the present disclosure provides a device, method, and system for distributed network flow monitoring.

[0004] BACKGROUND

[0005] Network flow monitoring is important in network management and operations. The measurement of flow-level statistics obtained through network flow monitoring can provide useful information for network management and operations, such as regulating bandwidth usage and carrying out capacity planning, accounting, and anomaly detection. For instance, Internet Service Providers (ISPs) can perform some tasks based on observed metrics, such as identifying the longest flow(s) for DDoS detection, evaluating RTT distribution for SLA guarantee, and the like. Due to the hardware limitations of network devices in the data plane, such measurements are nowadays performed using synopsis data structures (e.g., sketches), which can provide approximate per-flow statistics at a sub-linear memory cost and with certain error bounds.

[0006] SUMMARY

[0007] Network-wide monitoring based on sketches may have several challenges. One of the challenges is how to optimize sketch assignment of existing network flows (e.g., distinct TCP / IP communications) to the various sketches available on network devices for enabling network-wide measurements. This is because it is not realistic to configure each network device to monitor each network flow. Further, the flow-to-sketch assignment cannot adapt to network configurations with possible changes (e.g., can adapt if routing paths are changed due to a network problem, support multi-path routing, etc.). Moreover, the accuracy of the flow-to- sketch assignment may be impacted by fluctuating traffic, which further changes the optimal flow-to-sketch assignment. In view of the above-mentioned problems and disadvantages, the present disclosure aims to improve network flow monitoring. For instance, an objective may be to introduce an improved mechanism of sketch assignment for network flow monitoring.

[0008] These and other objectives are achieved by this disclosure, for instance, as described in the independent claims. Advantageous implementations are further described in the dependent claims.

[0009] A first aspect of the present disclosure provides a controller for flow monitoring of a network. The network comprises a plurality of network entities for monitoring a plurality of flows (e.g., on a data plane). A controller is used for controlling and / or configuring the network entities (e.g., on a control plane) for distributed flow monitoring. The controller is configured to obtain flow information on the plurality of flows from the plurality of network entities during a first epoch and perform sketch assignment among the plurality of network entities for a second epoch subsequent to the first epoch based on the obtained flow information. For performing sketch assignment, the controller is configured to determine whether each of the plurality of network entities is configured to monitor a corresponding flow using a sketch or ignore at least a part of the corresponding flow.

[0010] In this disclosure, the decision / result determined by the controller of whether each of the plurality of network entities is configured to monitor a corresponding flow using a sketch or ignore at least a part of the corresponding flow may also be referred to as a flow-to-sketch assignment, flow-sketch assignment, flow-to-device assignment, or flow-device assignment.

[0011] In this way, the sketch assignment can be optimized with respect to existing flows.

[0012] In an implementation form of the first aspect, the controller may be configured to obtain the flow information and perform the sketch assignment in an iterative manner.

[0013] In a further implementation form of the first aspect, the flow information may comprise statistical data of the plurality of flows.

[0014] In a further implementation form of the first aspect, the statistical data of the plurality of flows may comprise one or more of: the number of monitored packets counted by each network entity during the first epoch; and the number of ignored packets counted by each network entity during the first epoch.

[0015] In a further implementation form of the first aspect, the controller may be further configured to: perform traffic prediction for the second epoch based on the statistical data, to obtain an estimation of the plurality of flows, and perform the sketch assignment further based on the estimation of the plurality of flows.

[0016] In this way, the sketch assignment can be further optimized and kept updated with respect to fluctuating traffic in the network.

[0017] In a further implementation form of the first aspect, for performing traffic prediction, the controller may be configured to: determine a first traffic upper bound of the number of monitored packets and a second traffic upper bound of the number of ignored packets; and predict, for each flow, a predicted load based on the first traffic upper bound and the second traffic upper bound.

[0018] In a further implementation form of the first aspect, the controller may be configured to perform the sketch assignment with an objective of error minimization, wherein the error (to be minimized) is determined based on sketch estimation error and uncovered path error for each flow.

[0019] In a further implementation form of the first aspect, the controller may be configured to perform the sketch assignment further under a first bound of a maximum error and / or under a second bound of a maximum number of ignored packets for one or more of the plurality of flows.

[0020] In a further implementation form of the first aspect, for performing sketch assignment, the controller may be configured to assign different ranges of unknown flow identities to different network entities for ignoring or monitoring corresponding unknown flows, respectively.

[0021] In a further implementation form of the first aspect, at least one flow of the plurality of flows may traverse the network via two or more network paths. A second aspect of the present disclosure provides a method for flow monitoring of a network. The network comprises a plurality of network entities for monitoring a plurality of flows (e.g., on a data plane). A controller is used for controlling and / or configuring the network entities (e.g., on a control plane) for flow monitoring. The method comprises the following steps: obtaining, by the controller, flow information on the plurality of flows from the plurality of network entities during a first epoch; and performing, by the controller, sketch assignment among the plurality of network entities for a second epoch subsequent to the first epoch based on the obtained flow information.

[0022] The step of performing sketch assignment comprises determining, by the controller, whether each of the plurality of network entities is configured to monitor a corresponding flow using a sketch or ignore at least a part of the corresponding flow.

[0023] In an implementation form of the second aspect, the flow information may comprise statistical data of the plurality of flows.

[0024] In a further implementation form of the second aspect, the statistical data of the plurality of flows may comprise one or more of: the number of monitored packets counted by each network entity during the first epoch; and the number of ignored packets counted by each network entity during the first epoch.

[0025] In a further implementation form of the second aspect, the method may further comprise: performing, by the controller, traffic prediction for the second epoch based on the statistical data, to obtain an estimation of the plurality of flows; and performing, by the controller, the sketch assignment further based on the estimation of the plurality of flows.

[0026] In a further implementation form of the second aspect, the step of performing traffic prediction may comprise: determining, by the controller, a first traffic upper bound of the number of monitored packets and a second traffic upper bound of the number of ignored packets; and predicting, by the controller for each flow, a predicted load based on the first traffic upper bound and the second traffic upper bound.

[0027] In a further implementation form of the second aspect, the method may comprise determining, by the controller, an objective of error minimization for performing sketch assignment, wherein the error to be minimized is determined based on sketch estimation error and uncovered path error for each flow.

[0028] In a further implementation form of the second aspect, the step of sketch assignment may be performed under a first bound of a maximum error and / or a second bound of a maximum number of ignored packets for one or more of the plurality of flows.

[0029] In a further implementation form of the second aspect, the step of sketch assignment may comprise assigning, by the controller, different ranges of unknown flow identities to different network entities for ignoring or monitoring corresponding unknown flows, respectively.

[0030] In a further implementation form of the second aspect, at least one flow of the plurality of flows may traverse the network via two or more network paths.

[0031] The method of the second aspect or any implementation form thereof may share the same or corresponding features and advantages as the controller of the first aspect or any implementation form thereof.

[0032] A third aspect of the present disclosure provides a system comprising a controller according to the first aspect or any implementation form thereof, and a plurality of network entities for transmitting a plurality of flows. Each network entity is configured to: determine flow information on the plurality of flows during a first epoch; provide the flow information to the controller; receive a sketch assignment (or a flow-to-sketch assignment) from the controller; and monitor one or more flows in accordance with the sketch assignment using a sketch. It is noted that the flow-to-sketch assignment indicates which flow is monitored by the network entity and which flow (or a part thereof) is ignored (not monitored) by the network entity.

[0033] A fourth aspect of the present disclosure provides a computer program comprising a program code for performing the method according to the second aspect or any of its implementation forms.

[0034] A fifth aspect of the present disclosure provides a non-transitory storage medium storing executable program code which, when executed by a processor (or a chipset), causes the method according to the second aspect or any of its implementation forms to be performed.

[0035] A sixth aspect of the present disclosure provides a chipset adapted to execute program code that causes the method according to the second aspect or any of its implementation forms to be performed.

[0036] It has to be noted that all devices, elements, units and means described in the present application could be implemented in the software or hardware elements or any kind of combination thereof. All steps which are performed by the various entities described in the present application as well as the functionalities described to be performed by the various entities are intended to mean that the respective entity is adapted to or configured to perform the respective steps and functionalities. Even if, in the following description of the present disclosure, a specific functionality or step to be performed by external entities is not reflected in the description of a specific detailed element of that entity which performs that specific step or functionality, it should be clear for a skilled person that these methods and functionalities can be implemented in respective software or hardware elements, or any kind of combination thereof.

[0037] BRIEF DESCRIPTION OF DRAWINGS

[0038] The above-described aspects and implementation forms will be explained in the following description in relation to the enclosed drawings, in which

[0039] FIG. 1 shows an example of a flow monitoring system according to this disclosure;

[0040] FIG. 2 shows a further example of a flow monitoring system according to this disclosure;

[0041] FIG. 3 shows a workflow applied to a controller according to this disclosure; FIG. 4 shows a flow for solving a bi-level optimization problem;

[0042] FIG. 5 shows an example of bounding device load for the next measurement epoch;

[0043] FIG. 6 an example of a flow-device assignment according to this disclosure;

[0044] FIG. 7 shows a diagram of a method according to this disclosure; and

[0045] FIG. 8 shows an example of a sketch estimation error.

[0046] DETAILED DESCRIPTION OF EMBODIMENTS

[0047] For monitoring flows in a network, due to the nature of sketch algorithms, the quality of the flow monitoring can largely change based on a sketch assignment in the network. The sketch assignment regards which flows are assigned to which sketch. This disclosure provides a solution for network-wide measurements that can adapt the sketch assignment dynamically, which can optimize decisions over time according to traffic fluctuations / predictions.

[0048] Along every path traversed by a network flow, a controller is provided to determine (i) whether to monitor the flow or not, and (ii) which device along the path is selected for monitoring. To take these kinds of decisions, the controller according to this disclosure relies on information collected by each device and determines the sketch assignment for the next measurement period (epoch) based on the collected information. The information collection and sketch assignment are performed by the controller periodically (or in an interactive manner), e.g., according to a length of a measurement epoch.

[0049] FIG. 1 shows an example of a flow monitoring system 100 according to this disclosure. The system (or network) 100 comprises a controller 110 and a plurality of network entities (or network devices) 120 (120’). The controller 110 is for controlling flow monitoring on a control plane. The plurality of network devices 120 are for data transmission and flow monitoring on a data plane. The data transmission is based on a plurality of flows. Each flow 130 (130’) may traverse the network along one or more paths formed by a number of network devices.

[0050] The controller 110 is configured to obtain flow information 121 (121’) on the plurality of flows 130 from the plurality of network devices 120 during a first epoch. An epoch is a unit of time interval during which each network entity performs flow monitoring and collect flow information. An epoch may also be referred to as a measurement epoch. The size of an epoch is variable and is not limited in this disclosure. For instance, an epoch maybe 1 second, 2 seconds, 5 seconds, or 10 seconds, etc.

[0051] As an example, the flow information 121 may comprise information on which flow(s) is traversed in each network entity. This may be reflected using a pair of flow ID and network device ID. Other information related to the flow (e.g., type, length, content, etc.) may also be comprised in the flow information 121. This is not limited in the present disclosure.

[0052] The controller 110 is further configured to perform sketch assignment among (or for) the plurality of network devices 120 for a second epoch subsequent to the first epoch based on the obtained flow information 121. For performing sketch assignment, the controller 110 is configured to determine whether each network device 120 is configured to: monitor a corresponding flow 130 using a sketch 129; or ignore at least a part of the corresponding flow 130.

[0053] It is noted that the notion of “ignoring” a flow in this disclosure shall be understood as “not monitoring” the flow. In this case, the flow (or the ignored part of the flow) may be simply sent / forwarded by the corresponding network device (if the network device is not the final destination).

[0054] Optionally, the controller 110 may configure a network device 120 to ignore an entire flow, or to ignore one or more specific packets (or flow segments) of a flow. This is not limited in this disclosure.

[0055] For performing sketch assignment, the controller 110 is further configured to send the result (or decision) of sketch assignment determination to the plurality of network devices 120. The result of sketch assignment may also be referred to as a flow-to-sketch assignment, flow-to-device assignment, flow-device assignment, or flow-sketch assignment 111 (H I’). That is, the step of performing sketch assignment may be understood as determining a flow-sketch assignment 111 (111’) for the network devices and sending the flow-sketch assignment 111 (111’) to the network devices 120(120’).

[0056] Notably, a flow (or data flow) 130 may be referred to as a set of data packets traversing in a network. The set of data packets (forming the flow) may share one or more common properties. The common properties may be based on any of (for example but not limited to): packet header field (such as source and destination IP addresses and port numbers), packet content, metainformation, and the like. Optionally, a flow in the present disclosure may be multi-path flow, which traverses the network via two or more network paths.

[0057] A sketch may be referred to as a synopsis data structure commonly used in algorithms that process data flows. The purpose of the sketch (or other synopsis data structures) is to create a compact summary of data flows to avoid the impracticality of storing the data flows in memory for processing, particularly when the size (or length) of the data flow is very large. Computations (e.g., determining statistics) can then be applied to this compact summary instead of the original data flow. The sketch may be: a data structure that uses an array of hash tables in which each bucket stores a counter, or an array of bits (bitmap).

[0058] The controller 110 is configured to obtain the flow information and perform the sketch assignment in an iterative manner. That is, at the end of each epoch, the controller 110 is configured to collect flow information and perform sketch assignment for the next epoch based on the collected flow information.

[0059] According to this disclosure, at each measurement epoch, a controller collects flow information and uses them to (i) provide aggregated network-wide measurements, and (ii) (re-)compute flow-to-sketch assignments in order to preserve the quality of provided measurements. To this end, the controller may be adapted to run an online sketch assignment optimizer configured to, for every path traversed by a specific flow: identify the most suitable devices along the path; decide whether to monitor or ignore the portion of the flow traversing that path, and select an option that leads to higher quality measurements on average, e.g., across all the flows.

[0060] Optionally, the flow information may comprise statistical data of the plurality of flows. The statistical data may comprise the number of monitored packets 131 counted by each network device during the first epoch and / or the number of ignored packets 132 counted by each network device during the first epoch.

[0061] Optionally, the controller 110 may be further configured to perform traffic prediction for the second epoch based on the statistical data, to obtain an estimation of the plurality of flows, and to perform the sketch assignment further based on the estimation of the plurality of flows. In this case, the steps of flow information collection, traffic prediction, and sketch assignment are performed iteratively by the controller 110.

[0062] It is not necessary for the controller 110 to perform traffic prediction before performing sketch assignment. Nevertheless, by performing traffic prediction and performing sketch assignment based on the predicted traffic, the accuracy of flow monitoring can be improved due to a better flow-to-sketch assignment.

[0063] For each network device, the result of sketch assignment received from the controller 110 may also be referred to as a flow-device assignment. The flow-device assignment regulates which packet flows are monitored (measured) using the local sketch, and which packet flows are ignored (not monitored). Within a measurement epoch, based on the flow-device assignment, each network device is configured to store some information about the flows. For instance, each network device may be configured to update two counters that count the overall number of handled (measured) packets 131 and ignored packets 132, respectively.

[0064] FIG. 2 shows a further example of a flow monitoring system according to this disclosure. FIG. 2 is built based on FIG. 1. In FIGs. 1-2, corresponding elements may share the same features and function likewise.

[0065] As depicted in FIG. 2, for each measurement epoch (e.g., every 1 second, 2 seconds, etc.), the controller 110 is configured to collect flow information (e.g., counters) 121 (12F) from available devices, e.g., at the end of the epoch. The controller 110 may comprise a data collection unit for this purpose.

[0066] Based on the collected flow information 121, the controller 110 may be configured to perform network- wide measurements. The controller 110 may comprise a measurement unit for this purpose. For instance, when count-min sketches are used for flow monitoring, the controller 110 may be configured to obtain measurements estimating the overall number of distinct packets in the network observed for a given flow. Optionally, the controller 110 may be further configured to perform traffic prediction based on the collected flow information 121, e.g., using a traffic predictor. Any conventional algorithm for traffic prediction may be used by the controller 110. Based on the measurements, the controller 110 may be further configured to run an optimization algorithm seeking optimal assignment between active flows and available sketches. For instance, the desired assignment may be the one that minimizes the expected measurement error for the next epoch.

[0067] Optionally, the error may be determined based on sketch estimation error and uncovered path error for each flow. The sketch estimation error is introduced due to the nature of sketch. For instance, as illustrated in FIG. 8, if a flow F is assigned to a network device D, the flow F introduces, in expectation, a marginal error on every other flow assigned to the network device D. Thus, the sketch estimation error would be high if there are too many overlaps in the sketch assignment. The uncovered path error is introduced if a flow should have been monitored but was not actually monitored by any network device. For instance, if a flow is not assigned to any network device along its transmission path, then packets of this flow are ignored and are not eventually counted within the network, which results in an uncovered path error. Thus, the uncovered path error would be high if there are too many uncovered paths in the sketch assignment. Thus, the sketch assignment may be seen as making a trade-off between the sketch estimation error and the uncovered path error.

[0068] It is also possible that custom metrics may be defined for various needs. For instance, for the worst-case scenario, the controller may be configured to perform the sketch assignment under a first bound of a maximum error and / or under a second bound of a maximum number of (expected) ignored packets for one or more of the plurality of flows.

[0069] The controller 110 may comprise a sketch assignment unit to run the optimization algorithm. For instance, the sketch assignment unit may be configured to obtain configuration information for flow monitoring. For instance, the configuration information may comprise information about available devices (e.g., network topology, routing, sketch sizes on each device), and a desired traffic predictor. Optionally, the sketch assignment unit may obtain additional parameters for one or more specific flows, such as desired bounds for estimation error and the number of ignored packets.

[0070] To evaluate the quality of scheduled assignments, the sketch assignment unit may be configured to interact with an error estimation unit comprised in the controller 110. The error estimation unit may compute (e.g., estimate) error upper-bounds based on proposed assignment solution and the traffic prediction for the next iteration (epoch). The traffic predictor may be optionally tuned to optimize against the worst-case traffic. The estimated error upper-bounds for each active flow are provided by the error estimation unit as output.

[0071] When the assignment for the next iteration is determined, the sketch assignment unit may be configured to update the flow-device assignment on each device accordingly.

[0072] FIG. 3 shows a workflow applied to a controller 110 according to this disclosure.

[0073] As depicted in FIG. 3, for initialization 301, the controller 110 may be adapted to obtain configuration information for sketch assignment. For data collection 302, the controller 110 is adapted to collect flow information for each measurement epoch. Optionally, the controller may be configured to perform traffic prediction 303. The controller is configured to perform sketch assignment 304 based on the collected flow information and / or optional predicted traffic. Error upper bounds are also obtained after sketch assignment 304.

[0074] Due to the nature of sketch algorithms, the quality of the provided measurements can largely change based on which active flows are assigned to which sketch. According to this disclosure, a solution for network-wide measurements is proposed to adapt the assignments between flows and sketches dynamically and optimize decisions over time according to traffic fluctuations / predictions.

[0075] Along every path traversed by a network flow, the controller 110 decides (i) whether to monitor the flow or not, and (ii) which network device along the path is the best candidate for monitoring.

[0076] The sketch assignment 304 may be considered as an Integer Linear Program (ILP). The problem may be simplified as to assign active flows to available sketches.

[0077] As an example, consider a use case of flow cardinality estimation (e.g., count-min sketches are deployed on network devices 120). The optimization objective of the ILP may be the minimization of the overall measurement error (i.e., the sum of all the size estimation errors for every active flow). The ILP formulation may be as follows: where variables xkvand yk vrepresent respectively the decision of monitoring flow k on node v and of ignoring flow k along any path comprising node v, while coefficient EVis the relative marginal error at the sketch available on node v. The coefficient EVmay be computed as the fraction of expected colliding flows on every single sketch. Alternatively, the relative error bound may be determined based on count-min sketch theory (i.e., £ = e / w, where w is the number of counters in each row of a sketch).

[0078] Each quantity Ck(v represents the estimated load (i.e., number of packets) expected on node v due to flow k. The overall error to be minimized is the sum of two components: (i) the first component modelling all the overestimation errors due to the sketch approximation on network devices where the flows are counted; (ii) the second component being the quantity of packets ignored due to partial coverage decisions. Constraint (Fl.2) ensures that, along a path P E P(k), being J’(fc) the set of all the paths traversed by flow k, there is exactly one sketch monitoring flow k, unless k is explicitly ignored.

[0079] Given a certain traffic prediction Ck(v) V k E K, v E V, the goal of the sketch assignment 304 may be considered as to compute assignment variables x and y that minimize the overall expected estimation error. A possible traffic predictor that provides adversarial values for Ck(v) may be used in the step of traffic prediction 303. To this end, the traffic predictor is configured to predict the worst-case traffic based on the assignment solution chosen by the assignment algorithm, which can be useful to provide conservative error upper bounds. A bi-level optimization problem may be formulated as follows, which may be solved by the traffic predictor to obtain the adversarial values for Ck(v):

[0080] The bi-level optimization problem may be divided in two parts: the first sub-problem being (F2a.l-3) and the second sub-problem being (F2b. l-5). The second sub-problem may be considered as a nested problem that constrains traffic C to the worst case (i.e., maximal error) with respect to assignment decisions x, y. This formulation may lead to minimizing an error upper bound that is computed based on the network topology and historical node loads. The constraints of the second sub-problem are as follows: constraint (F2b. 2) that bounds the quantity of packets per flow on each edge to the edge capacity ce, wherein aP kis the number of packets flow k sends over its path P that comprises edge e; constraint (F2b. 3) ensuring that the load on each node v coresponds with the load of all the edges attached to v; constraints (F26.4) and (F26.5) that bounds the total number of packets expected respectively from previously handled and ignored flow on each node, wherein overall bounds C(v) and C(v) can be computed by means of multiple strategy (e.g., exponential moving average).

[0081] An example of solving the bi-level optimization problem is illustrated in FIG. 4, which provides a simple local search heuristic. FIG. 5 shows an example of bounding device load for the next measurement epoch. In FIGs. 1- 5, corresponding elements may share the same features and function likewise.

[0082] It is noted that the traffic predictor of FIG. 2 is configured to predict traffic without ground truth information about each flow frequency. Since the only available per-flow information is the one fetched by the controller 110 from the approximate sketch counters of each network device 120. When count-min sketches are used, the count-min sketches overestimate the number of packets of each flow. In this case, two ground truth counters may be used to bound at least the total amount of packets that crossed each network device during one iteration. The two ground truth counters may be two overall counters: one indicating the overall number of monitored packets 131, one indicating the overall number of ignored packets 132.

[0083] As shown in FIG. 5, two (traffic) upper bounds for the total number of monitored (or counted) and ignored packets are separately estimated by the controller 110, e.g., using the two counters that each network device updates for each received packet (c.f. FIGs. 1 or 2).

[0084] The first upper bound may be determined as:

[0085] The second upper bound may be determined as:

[0086] (F5.2).

[0087] Based on the first and the second upper bounds, the controller 110 may be adapted to predict a predicted load for each flow.

[0088] Optionally, an exponential moving average may be used to estimate the two upper bounds for the next iteration based on previous values. The two estimated upper bounds are then used in the second sub-problem introduced with respect to FIGs. 3-4, e.g., the “Follower” in FIG. 4 to predict per-flow packets in the worst-case scenario.

[0089] FIG. 6 shows an example of a flow-device assignment according to this disclosure. The flowdevice assignment provides a mechanism to each device in order to discriminate packets that should be monitored locally and those that should be ignored (not monitored) in the context of flow monitoring. Since the assignment is performed per-epoch through a control plane, one possible solution is to fill a Match Action Table (MAT) with information about active flows and a corresponding action to perform. This prevents the need for packet tagging, hence keeping the monitoring system transparent. Optionally, a blacklist approach may be used for the sketch assignment. That is, the flow-device assignment (e.g., the MAT) may only comprise information (e.g., flow ID) identifying the flow(s) that should be ignored. A default option (known / agreed by the controller 110 and network device 120) is to monitor a flow (if the flow is not blacklisted).

[0090] For instance, FIG. 6 illustrates a blacklist approach in that:

[0091] (i) whenever a new / updated / modified sketch assignment is scheduled, the control plane (e.g., the controller 110) may be configured to populate a MAT comprising to-be-ignored flow ID(s) and provide the MAT to each network device;

[0092] (ii) upon receiving of a packet of a flow, a network device queries the MAT and, if the flow ID is present, the packet of the flow is not counted (the local count-min sketch (CMS) of the network device is not updated).

[0093] This blacklist approach can allow a flow monitoring system to correctly handle also previously unknown flows, i.e., any new flow spawning during the current measurement epoch for the first time. It is possible that such previously unknown flows may be monitored by too many network devices of the network, triggering the update of the CMS almost all over the network. This may reduce the accuracy of flow monitoring. To tackle this issue, for performing the step of sketch assignment 304, the controller 110 may be configured to assign unknown flows to different network devices. An unknown flow may be referred to as a new flow that is firstly appeared in the network (e.g., with a new flow ID in the network). For instance, different sets of network devices may be assigned to monitor different flow ID ranges. In this way, the problem the same packets handled multiple times affecting the global monitoring accuracy can be mitigated.

[0094] FIG. 7 shows a method 700 according to this disclosure. The method 700 is for flow monitoring of a network. The network comprises a plurality of network entities for monitoring a plurality of flows (e.g., in a data plane) and a controller for controlling the network entities (e.g., in the data plane). The method comprises the following steps: step 701 : obtaining, by the controller, flow information on the plurality of flows from the plurality of network entities during a first epoch; step 702: performing, by the controller, sketch assignment among the plurality of network entities for a second epoch subsequent to the first epoch based on the obtained flow information.

[0095] The step of performing sketch assignment comprises determining, by the controller, whether each of the plurality of network entities is configured to monitor a corresponding flow using a sketch or ignore at least a part of the corresponding flow.

[0096] Optionally, after step 701 and before step 702, the method may further comprise step 709: performing, by the controller, traffic prediction based on the flow information, to obtain an estimation of the plurality of flows (flow estimation). In this case, the sketch assignment is performed further based on the flow estimation.

[0097] The method 700 may share the same / corresponding features disclosed with respect to FIGs. 1- 6, which are not duplicated herein.

[0098] In summary, the present disclosure provides a solution for flow monitoring such that the flowdevice (sketch) assignment can be actively and dynamically updated periodically (e.g., for each measurement epoch). In this way, the flow-device assignment can be optimized (e.g., distinct TCP / IP communications) with respect to various sketches available on network devices for enabling network-wide measurements. Moreover, the flexibility of the flow monitoring can be improved with respect to various network configurations (e.g., sketch assignment can be adapted if routing paths are changed due to a network problem, support multi-path routing, etc.). Further, the sketch assignment can be kept optimized with respect to fluctuating traffic trends, which can properly benefit from the distribution of the measurement task.

[0099] The present disclosure may be applied to any computer / communications network. The controller and the network entity (device) in this disclosure each may comprise processing circuitry or a chipset (not shown) configured to respectively perform, conduct or initiate the various operations described herein. The processing circuitry may comprise hardware and software. The hardware may comprise analog circuitry or digital circuitry, or both analog and digital circuitry. The digital circuitry may comprise components such as application-specific integrated circuits (ASICs), field-programmable arrays (FPGAs), digital signal processors (DSPs), or multi-purpose processors. Optionally, the processing circuitry (or the chipset) comprises one or more processors and a non-transitory memory connected to the one or more processors. The non-transitory memory may carry executable program code which, when executed by the one or more processors, causes the controller and the network entity to respectively perform, conduct or initiate the operations or methods described herein.

[0100] The present disclosure has been described in conjunction with various embodiments as examples as well as implementations. However, other variations can be understood and effected by those persons skilled in the art and practicing the claimed invention, from the studies of the drawings, this disclosure and the independent claims. In the claims as well as in the description the word “comprising” does not exclude other elements or steps and the indefinite article “a” or “an” does not exclude a plurality. A single element or other unit may fulfill the functions of several entities or items recited in the claims. The mere fact that certain measures are recited in the mutual different dependent claims does not indicate that a combination of these measures cannot be used in an advantageous implementation.

Claims

CLAIMS1. A controller (110) for flow monitoring of a network, wherein the network comprises a plurality of network entities (120) for monitoring a plurality of flows (130), and the controller (110) is configured to: obtain flow information (121) on the plurality of flows (130) from the plurality of network entities (120) during a first epoch; perform sketch assignment among the plurality of network entities (120) for a second epoch subsequent to the first epoch based on the obtained flow information (121), wherein for performing sketch assignment, the controller (110) is configured to determine whether each of the plurality of network entities (120) is configured to monitor a corresponding flow using a sketch (129) or ignore at least a part of the corresponding flow.

2. The controller (110) according to claim 1, wherein the controller (110) is configured to obtain the flow information (121) and perform the sketch assignment in an iterative manner.

3. The controller (110) according to claim 1 or 2, wherein the flow information (121) comprises statistical data of the plurality of flows (130).

4. The controller (110) according to claim 3, wherein the statistical data of the plurality of flows (130) comprises one or more of the number of monitored packets counted (131) by each network entity during the first epoch; and the number of ignored packets counted (132) by each network entity during the first epoch.

5. The controller (110) according to claim 3 or 4, wherein the controller (110) is further configured to: perform traffic prediction for the second epoch based on the statistical data, to obtain an estimation of the plurality of flows (130), and perform the sketch assignment further based on the estimation of the plurality of flows(130).

6. The controller (110) according to claim 5, wherein for performing traffic prediction, the controller (110) is configured to: determine a first traffic upper bound of the number of monitored packets and a second traffic upper bound of the number of ignored packets; and predict, for each flow, a predicted load based on the first traffic upper bound and the second traffic upper bound.

7. The controller (110) according to any one of claims 1 to 6, wherein the controller (110) is configured to perform the sketch assignment with an objective of error minimization, wherein the error is determined based on sketch estimation error and uncovered path error for each flow.

8. The controller (110) according to claim 7, wherein the controller (110) is configured to perform the sketch assignment further under a first bound of a maximum error and / or under a second bound of a maximum number of ignored packets for one or more of the plurality of flows (130).

9. The controller (110) according to any one of claims 1 to 8, wherein for performing sketch assignment, the controller (110) is configured to assign different ranges of unknown flow identities to different network entities (120) for ignoring or monitoring corresponding unknown flows, respectively.

10. The controller (110) according to any one of claims 1 to 9, wherein at least one flow of the plurality of flows traverses the network via two or more network paths.

11. A method (700) for flow monitoring of a network, wherein the network comprises a plurality of network entities for monitoring a plurality of flows, and the method comprises: obtaining (701), by a controller, flow information on the plurality of flows from the plurality of network entities during a first epoch; performing (702), by the controller, sketch assignment among the plurality of network entities for a second epoch subsequent to the first epoch based on the obtained flow information, wherein the step of performing sketch assignment comprises determining, by the controller, whether each of the plurality of network entities is configured to monitor a corresponding flow using a sketch or ignore at least a part of the corresponding flow.

12. The method (700) according to claim 11, wherein the flow information comprises statistical data of the plurality of flows.

13. The method (700) according to claim 12, wherein the method further comprises: performing, by the controller, traffic prediction for the second epoch based on the statistical data, to obtain an estimation of the plurality of flows; and performing, by the controller, the sketch assignment further based on the estimation of the plurality of flows.

14. A system (100) comprising a controller (110) according to any one of claims 1 to 10, and a plurality of network entities (120), wherein each network entity (120) is configured to: determine flow information (121) on a plurality of flows during a first epoch; provide the flow information (121) to the controller (110); receive a sketch assignment (111) from the controller (110); and monitor one or more flows (130) in accordance with the sketch assignment (111) using a sketch.

15. A computer program comprising instructions which, when the program is executed by a computer, cause the computer to perform the method according to any one of claims 11 to 13.

Images