Parallel Distinct-Flow Counters for Network Traffic Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing traffic monitoring systems in communication networks face challenges in efficiently estimating multiple distinct flows, especially in high-traffic networks with large numbers of distinct flows, which can be expensive and infeasible to count exactly.
Innovation Solution
A network switch with multiple hardware-implemented distinct-flow counters that estimate distinct flows by evaluating packet-header fields, using a small-footprint memory structure and updating count states on a packet-by-packet basis, allowing for parallel counting and efficient detection of traffic anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple distinct-flow counters are implemented to monitor various traffic patterns, then traffic monitoring capability and anomaly detection accuracy are improved, but device complexity and resource consumption increase
Solution Approach 1:
The system divides the traffic monitoring function into multiple independent distinct-flow counters, each responsible for counting distinct flows based on specific packet header fields. Each counter operates independently with its own configuration, allowing parallel monitoring of different traffic patterns without interfering with each other, thus improving detection accuracy while maintaining manageable complexity through modular design
Solution Approach 2:
The distinct-flow counters are designed with universal functionality to handle multiple traffic monitoring scenarios. Each counter can be configured with different packet header fields (source IP, destination IP, source port, destination port, protocol) to monitor various traffic patterns, making the system adaptable to different monitoring needs without requiring separate dedicated counters for each scenario
2Measurement precision
If exact counting of distinct flows is performed, then counting accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
The system uses hash functions to map packet flows to counter indices, creating a compressed representation of flow data. Instead of storing and processing complete flow information, the system maintains compact counter structures that store only the essential counting state, significantly reducing memory usage and processing overhead while maintaining counting accuracy through probabilistic hash-based indexing
3Measurement precision
If packet-header fields are evaluated for each packet to estimate distinct flows, then flow counting accuracy is improved, but processing speed decreases
Solution Approach 1:
The system pre-configures the distinct-flow counters with their counting parameters and hash functions before actual traffic monitoring begins. This preliminary setup includes defining which packet header fields to evaluate and configuring the counter structures, so that during runtime, packets can be processed quickly without repeated configuration overhead, maintaining both accuracy and speed
Data Source
AI summary
A network switch includes circuitry, multiple ports and multiple hardware-implemented distinct-flow counters. The multiple ports are configured to receive packets from a communication network. Each of the multiple hardware-implemented distinct-flow counters is configured to receive (i) a respective count definition specifying one or more packet-header fields and (ii) a respective subset of the received packets, and to estimate a respective number of distinct flows that are present in the subset, by evaluating, over the packets in the subset, a number of distinct values in the packet-header fields belonging to the count definition. The circuitry is configured to provide each of the distinct-flow counters with the respective subset of the received packets, including providing a given packet to a plurality of the distinct-flow counters, and to identify an event-of-interest based on numbers of distinct flows estimated by the distinct-flow counters.