A Feasibility Study on Time-aware Monitoring with Commodity Switches

Network monitoring and measurement are important tasks for operating large-scale cloud networks. Recently, the confluence of programmable networking hardware and streaming algorithms has given rise to a class of memory-efficient algorithms that can run entirely in the switch data plane. However, existing systems cannot support the notion of time, and therefore are oblivious to data recency. Generally, capturing recent events is essential for reasoning about the most relevant trends, and the same holds for network monitoring. Recent data, whether for SLA monitoring or attack detection, is more useful and actionable. The key question we consider in this paper is how to perform time-aware monitoring on commodity switches with programmable data planes. Our contribution is a feasibility study that: a) identifies a class of hardware-friendly algorithms for time-aware monitoring, b) customizes their key operations to the P4 model, c) develops a Tofino hardware prototype as concrete evidence, and d) obtains promising early results on real-world datasets.