[Paper Review] Routing Oblivious Measurement Analytics

Ran Ben Basat, Xiaoqi Chen+4 more|arXiv (Cornell University)|May 23, 2020

Network Security and Intrusion Detection41 references4 citations

TL;DR

AROMA is a routing- and workload-oblivious measurement infrastructure that enables uniform packet and flow sampling in programmable PISA switches without assumptions about topology, routing, or switch coordination. It uses a k-partition hash-based structure to ensure accurate, low-overhead network-wide analytics with formal accuracy guarantees, outperforming existing methods in flow size estimation, heavy hitter detection, and superspreader identification even under memory constraints.

ABSTRACT

Network-wide traffic analytics are often needed for various network monitoring tasks. These measurements are often performed by collecting samples at network switches, which are then sent to the controller for aggregation. However, performing such analytics without ``overcounting'' flows or packets that traverse multiple measurement switches is challenging. Therefore, existing solutions often simplify the problem by making assumptions on the routing or measurement switch placement. We introduce AROMA, a measurement infrastructure that generates a uniform sample of packets and flows regardless of the topology, workload and routing. Therefore, AROMA can be deployed in many settings, and can also work in the data plane using programmable PISA switches. The AROMA infrastructure includes controller algorithms that approximate a variety of essential measurement tasks while providing formal accuracy guarantees. Using extensive simulations on real-world network traces, we show that our algorithms are competitively accurate compared to the best existing solutions despite the fact that they make no assumptions on the underlying network or the placement of measurement switches.

Motivation & Objective

• To address the challenge of overcounting in network-wide traffic measurements due to multi-switch traversal of packets and flows.
• To eliminate reliance on routing assumptions, topology knowledge, or per-switch configuration in flow and packet sampling.
• To support accurate, scalable network measurement tasks—such as heavy hitter detection and flow size distribution estimation—on resource-constrained PISA switches.
• To provide formal accuracy guarantees for a wide range of measurement primitives without requiring coordination between measurement switches.
• To enable deployment in dynamic, large-scale networks where topology and traffic patterns change frequently.

Proposed method

• AROMA employs a k-partition hash-based structure to assign each packet or flow to a unique sampling bucket, ensuring uniform sampling regardless of routing or topology.
• The system uses a single, consistent hash function across all switches, eliminating the need for inter-switch coordination or packet marking.
• It supports both packet sampling (each packet sampled with fixed probability) and flow sampling (each flow sampled uniformly, independent of size) via the same underlying mechanism.
• The controller uses sampled data to approximate key network measurements, including flow frequency, heavy hitters, hierarchical heavy hitters, and flow size distribution.
• All algorithms are designed to operate within minimal memory (e.g., 0.5MB) and are compatible with P4 and PISA programmable switches.
• The framework ensures formal accuracy guarantees through probabilistic bounds on estimation errors, even under high-volume traffic.

Experimental results

Research questions

• RQ1 Can uniform sampling of packets and flows be achieved in a network-wide setting without assumptions about routing, topology, or switch placement?
• RQ2 How can flow sampling be performed uniformly across switches without per-switch configuration or coordination?
• RQ3 What is the achievable accuracy of network-wide measurement tasks—such as heavy hitter detection and flow size estimation—using minimal memory and no routing assumptions?
• RQ4 How does AROMA’s performance compare to existing solutions in terms of estimation accuracy and resource efficiency on real-world traces?
• RQ5 Can AROMA be efficiently implemented in the data plane using PISA switches with limited memory and computational resources?

Key findings

• With only 0.5MB of memory, AROMA estimates flow sizes with a root mean square error of just 150 packets on a 32-million-packet trace.
• AROMA achieves an F1 score of 0.9 in identifying superspreaders and 0.8 in detecting heavy hitters, outperforming FlowRadar in recall while maintaining near-perfect precision.
• The flow size distribution is estimated with a weighted mean relative difference of only 0.045, demonstrating high accuracy even under memory constraints.
• AROMA’s performance is competitive with state-of-the-art solutions that rely on routing assumptions, but it operates without them, making it more broadly deployable.
• The framework improves update time from logarithmic to constant in software-based packet sampling, enhancing scalability.
• AROMA is the first to enable flow sampling without coordination or assumptions about routing, workload, or topology, while remaining compatible with PISA switches.