REMO: Resource efficient distributed network monitoring

Abstract

Increasing the traffic visibility, by monitoring network flow packets, provides valuable information for various network management tasks. The mirroring mode of flow packet monitoring requires the switches and routers to duplicate packets of interest, and to send them to flow monitors for in-depth analysis. A common practice to avoid the interference between the original and the mirrored flows is to transmit them separately, in two different planes (data plane and monitoring plane, respectively). In this paper, we aim at reducing the overall cost of transmitting both the original and mirrored flows. Towards that end, we present a generic monitoring framework called REMO. The key idea of REMO is twofold: (i) placing the flow monitors in central locations, and (ii) passing the original flows through the vicinity of the monitors. By doing so, REMO reduces the resources consumed in the monitoring plane, without unworthily increasing the resource consumption in the data plane. The results of extensive numerical simulations show that REMO effectively reduces the overall transmission cost, remarkably outperforming several baseline strategies, particularly when the transmission is more expensive in the monitoring plane.