An information-theoretic approach to network monitoring and measurement

Yong Liu, Don Towsley, Tao Ye, Jean Bolot

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Network engineers and operators are faced with a number of challenges that arise in the context of network monitoring and measurement. These include: i) how much information is included in measurement traces and by how much can we compress those traces?, ii) how much information is captured by different monitoring paradigms and tools ranging from full packet header captures to flow-level captures (such as with NetFlow) to packet and byte counts (such as with SNMP)? and iii) how much joint information is included in traces collected at different points and can we take advantage of this joint information? In this paper we develop a network model and an information theoretic framework within which to address these questions. We use the model and the framework to first determine the benefits of compressing traces captured at a single monitoring point, and we outline approaches to achieve those benefits. We next consider the benefits of joint coding, or equivalently of joint compression of traces captured a different monitoring points. Finally, we examine the difference in information content when measurements are made at either the flow level or the packet/byte count level. In all of these cases, the effect of temporal and spatial correlation on the answers to the above questions is examined. Both our model and its predictions are validated against measurements taken from a large operational network.

Original languageEnglish (US)
Title of host publicationProceedings of the 5th ACM SIGCOMM Conference on Internet Measurement, IMC 2005
Pages159-172
Number of pages14
StatePublished - 2005
Event5th ACM SIGCOMM Conference on Internet Measurement, IMC 2005 - Berkeley, CA, United States
Duration: Oct 19 2005Oct 21 2005

Other

Other5th ACM SIGCOMM Conference on Internet Measurement, IMC 2005
CountryUnited States
CityBerkeley, CA
Period10/19/0510/21/05

Fingerprint

Monitoring
Engineers

ASJC Scopus subject areas

  • Software
  • Computer Networks and Communications

Cite this

Liu, Y., Towsley, D., Ye, T., & Bolot, J. (2005). An information-theoretic approach to network monitoring and measurement. In Proceedings of the 5th ACM SIGCOMM Conference on Internet Measurement, IMC 2005 (pp. 159-172)

An information-theoretic approach to network monitoring and measurement. / Liu, Yong; Towsley, Don; Ye, Tao; Bolot, Jean.

Proceedings of the 5th ACM SIGCOMM Conference on Internet Measurement, IMC 2005. 2005. p. 159-172.

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Liu, Y, Towsley, D, Ye, T & Bolot, J 2005, An information-theoretic approach to network monitoring and measurement. in Proceedings of the 5th ACM SIGCOMM Conference on Internet Measurement, IMC 2005. pp. 159-172, 5th ACM SIGCOMM Conference on Internet Measurement, IMC 2005, Berkeley, CA, United States, 10/19/05.
Liu Y, Towsley D, Ye T, Bolot J. An information-theoretic approach to network monitoring and measurement. In Proceedings of the 5th ACM SIGCOMM Conference on Internet Measurement, IMC 2005. 2005. p. 159-172
Liu, Yong ; Towsley, Don ; Ye, Tao ; Bolot, Jean. / An information-theoretic approach to network monitoring and measurement. Proceedings of the 5th ACM SIGCOMM Conference on Internet Measurement, IMC 2005. 2005. pp. 159-172
@inproceedings{54959bbffe5445f0ac22ec332167a1e3,
title = "An information-theoretic approach to network monitoring and measurement",
abstract = "Network engineers and operators are faced with a number of challenges that arise in the context of network monitoring and measurement. These include: i) how much information is included in measurement traces and by how much can we compress those traces?, ii) how much information is captured by different monitoring paradigms and tools ranging from full packet header captures to flow-level captures (such as with NetFlow) to packet and byte counts (such as with SNMP)? and iii) how much joint information is included in traces collected at different points and can we take advantage of this joint information? In this paper we develop a network model and an information theoretic framework within which to address these questions. We use the model and the framework to first determine the benefits of compressing traces captured at a single monitoring point, and we outline approaches to achieve those benefits. We next consider the benefits of joint coding, or equivalently of joint compression of traces captured a different monitoring points. Finally, we examine the difference in information content when measurements are made at either the flow level or the packet/byte count level. In all of these cases, the effect of temporal and spatial correlation on the answers to the above questions is examined. Both our model and its predictions are validated against measurements taken from a large operational network.",
author = "Yong Liu and Don Towsley and Tao Ye and Jean Bolot",
year = "2005",
language = "English (US)",
pages = "159--172",
booktitle = "Proceedings of the 5th ACM SIGCOMM Conference on Internet Measurement, IMC 2005",

}

TY - GEN

T1 - An information-theoretic approach to network monitoring and measurement

AU - Liu, Yong

AU - Towsley, Don

AU - Ye, Tao

AU - Bolot, Jean

PY - 2005

Y1 - 2005

N2 - Network engineers and operators are faced with a number of challenges that arise in the context of network monitoring and measurement. These include: i) how much information is included in measurement traces and by how much can we compress those traces?, ii) how much information is captured by different monitoring paradigms and tools ranging from full packet header captures to flow-level captures (such as with NetFlow) to packet and byte counts (such as with SNMP)? and iii) how much joint information is included in traces collected at different points and can we take advantage of this joint information? In this paper we develop a network model and an information theoretic framework within which to address these questions. We use the model and the framework to first determine the benefits of compressing traces captured at a single monitoring point, and we outline approaches to achieve those benefits. We next consider the benefits of joint coding, or equivalently of joint compression of traces captured a different monitoring points. Finally, we examine the difference in information content when measurements are made at either the flow level or the packet/byte count level. In all of these cases, the effect of temporal and spatial correlation on the answers to the above questions is examined. Both our model and its predictions are validated against measurements taken from a large operational network.

AB - Network engineers and operators are faced with a number of challenges that arise in the context of network monitoring and measurement. These include: i) how much information is included in measurement traces and by how much can we compress those traces?, ii) how much information is captured by different monitoring paradigms and tools ranging from full packet header captures to flow-level captures (such as with NetFlow) to packet and byte counts (such as with SNMP)? and iii) how much joint information is included in traces collected at different points and can we take advantage of this joint information? In this paper we develop a network model and an information theoretic framework within which to address these questions. We use the model and the framework to first determine the benefits of compressing traces captured at a single monitoring point, and we outline approaches to achieve those benefits. We next consider the benefits of joint coding, or equivalently of joint compression of traces captured a different monitoring points. Finally, we examine the difference in information content when measurements are made at either the flow level or the packet/byte count level. In all of these cases, the effect of temporal and spatial correlation on the answers to the above questions is examined. Both our model and its predictions are validated against measurements taken from a large operational network.

UR - http://www.scopus.com/inward/record.url?scp=84878715338&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84878715338&partnerID=8YFLogxK

M3 - Conference contribution

AN - SCOPUS:84878715338

SP - 159

EP - 172

BT - Proceedings of the 5th ACM SIGCOMM Conference on Internet Measurement, IMC 2005

ER -