Traffic monitoring is essential to manage large networks and validate Service Level Agreements. Passive monitoring is particularly valuable to promptly identify transient fault episodes and react in a timely manner. This article proposes a novel, non-invasive and flexible method to passively monitor large backbone networks. By using only packet counters, commonly available on existing hardware, we can accurately measure packet losses, in different segments of the network, affecting only specific flows. We can monitor not only end-to-end flows, but any generic flow with packets following several different paths in the network (multipoint flows). We also sketch a possible extension of the method to measure average one-way delay for multipoint flows, provided that the measurement points are synchronized. Through various experiments we show that the method is effective and enables easy zooming in on the cause of packet losses. Moreover, the method can scale to very large networks with a very low overhead on the data plane and the management plane.

中文翻译：

---

分组网络中的多点被动监视

流量监视对于管理大型网络和验证服务水平协议至关重要。被动监视对于迅速识别瞬态故障事件并及时做出反应特别有用。本文提出了一种新颖，无创且灵活的方法来被动监视大型骨干网。通过仅使用现有硬件上常见的数据包计数器，我们可以准确地测量网络不同部分中仅影响特定流的数据包丢失。我们不仅可以监视端到端流，还可以监视具有遵循网络中多个不同路径的数据包的任何通用流（多点流）。我们还概述了该方法的一种可能扩展，即只要测量点同步，就可以测量多点流的平均单向延迟。通过各种实验，我们证明了该方法是有效的，并且可以轻松放大丢包的原因。此外，该方法可以在数据平面和管理平面上以非常低的开销扩展到非常大的网络。