Flexible Network Monitoring with FLAME.pdfVIP

Flexible Network Monitoring with FLAME K. G. Anagnostakis a,?, M. B. Greenwald c, S. Ioannidis d, D. Li b, J. M. Smith b aInstitute for Infocomm Research, 21 Heng Mui Keng Terrace, Singapore 119613 bDistributed Systems Laboratory, CIS Department, University of Pennsylvania 200 S. 33rd Street, Philadelphia, PA 19104, USA cBell Labs, 600 Mountain Ave, Murray Hill, NJ 07974, USA dCS Department, Stevens Institute of Technology, Hoboken, NJ 07030, USA Abstract Increases in scale, complexity, dependency and security for networks have motivated increased automation of activities such as network monitoring. We have employed technology derived from active networking research to develop a series of network monitoring systems, but unlike most previous work, made application needs the priority over infrastructure properties. This choice has produced the following results: (1) the techniques for general in- frastructure are both applicable and portable to specific applications such as network monitoring; (2) tradeoffs can benefit our applications while preserving considerable flexibility; and (3) careful engineering allows applications with open architectures to perform competitively with custom-built static implementations. These results are demonstrated via measurements of the Lightweight Active Mea- surement Environment (LAME), its successor, Flexible LAME (FLAME), and their application to monitoring for performance and security. 1 Introduction The bulk of research on Active Networks [1,2] has been directed towards build- ing general infrastructure [3,4], with relatively little research driven by partic- ? Corresponding author. Email addresses: kostas@.sg (K. G. Anagnostakis), greenwald@ (M. B. Greenwald), si@ (S. Ioannidis), dekai@ (D. Li), jms@ (J. M. Smith). Preprint submitted to Elsevier Science 3 October 2005 ular network functions. Recently, the focus has shifted slightly as researchers seek network functions with a clear need for some form of extensibility, and design