The Traffic Monitoring and Sampling Service Sample Clauses

The Traffic Monitoring and Sampling Service. As shown in the Figure 8, the traffic monitoring and sampling service belongs to the Monitoring Engine (ME) and more specifically to the set of passive monitoring points (passive MP). Figure 11: Architecture of the Traffic Monitoring and Sampling Service We design and develop the traffic monitoring and sampling component as an extension of Softflowd (xxxx://xxx.xxxxxxx.xxx/projects/). Indeed, Softflowd is a flow based network traffic analyzer capable of Cisco NetFlow data export. It fully tracks 5-tuples traffic flows by listening on a network interface. These flows are then reported via NetFlow reports to a collecting host. Note that Softflowd does not include support for packet sampling neither fixed nor adaptive. Our extensions to Softflowd add this sampling functionality, which is essential for monitoring scalability. They also allow the integration of this tool over emulated nodes within our traffic emulation service, while being able to run over real routers by sniffing packets directly on their interfaces. Indeed, as shown in Figure 11, the traffic monitoring and sampling service could either work with TcpDump packets headers received from an emulated monitor within the traffic emulation service via the Virtual Interface Module described in Figure 11 of work directly on a real node interface. In the latter case, it captures traffic promiscuously using the Pcap library as described in Figure 11. Note that it is likely that the sampling module will place additional load on hosts or gateways on which it runs. Our implementation has been designed to minimize this load as much as possible. Indeed, in order to decide either to retain the packet being read or to reject it, the sampling module makes a decision each time the Pcap library returns a handle to a new packet and before the packet is being loaded to the memory. If the result of the sampling algorithm is to capture the packet, the entire packet is then loaded and the maintained flow list is updated via the NetFlow flow constructer module, otherwise the packet is simply discarded. As described in Figure 11, the sampling module encloses a sampling algorithm as a core and a sampling rate control server. The default sampling algorithm we are providing is the following: if a user chooses a sampling rate of A/B (A packets among B packets, A <= B, B > 0, A >= 0), then every B packets, the sampling module generates randomly a set S of A numbers within the interval [1, B]. Packets with numbers outside the s...