The advent of Software-Defined Networking with OpenFlow first, and subsequently the emergence of programmable data planes, has boosted lots of research around many networking aspects: monitoring, security, traffic engineering. In the context of monitoring, most of the proposed solutions show the benefits of data plane programmability by simplifying the network complexity with a one big-switch abstraction. Only few papers look at network-wide solutions, but consider the network only composed by programmable devices. In this paper, we argue that the primary challenge for a successful adoption of those solutions is the deployment problem: how to compose and monitor a network consisting of both legacy and programmable switches? We propose an approach for incrementally deploy programmable devices in an ISP network with the goal of monitoring as many distinct network flows as possible. While assessing the benefits of our solution, we realized that proposed network-wide monitoring algorithms might not be optimized for a partial deployment scenario. We then also developed and implemented in P4 a novel strategy capable of detecting network-wide heavy flows: results show that it can achieve better accuracy than state-of-the-art solutions while relying on less information from the data plane and leading to only marginal additional packet processing time.

中文翻译：

---

一种可增量部署的支持 P4 的架构，用于全网重击检测

首先是使用 OpenFlow 的软件定义网络的出现，以及随后可编程数据平面的出现，推动了围绕许多网络方面的大量研究：监控、安全、流量工程。在监控环境中，大多数提议的解决方案通过使用一个大交换机抽象简化网络复杂性来展示数据平面可编程性的好处。只有少数论文着眼于网络范围的解决方案，但考虑了仅由可编程设备组成的网络。在本文中，我们认为成功采用这些解决方案的主要挑战是部署问题：如何组成和监控由传统交换机和可编程交换机组成的网络？我们提出了一种在 ISP 网络中增量部署可编程设备的方法，目的是监控尽可能多的不同网络流。在评估我们的解决方案的好处时，我们意识到提议的全网监控算法可能无法针对部分部署场景进行优化。然后，我们还在 P4 中开发并实施了一种能够检测网络范围内大量流量的新策略：结果表明，它可以实现比最先进的解决方案更好的准确性，同时依赖来自数据平面的更少信息，并且只导致边际额外的数据包处理时间。我们意识到提议的全网监控算法可能不会针对部分部署场景进行优化。然后，我们还在 P4 中开发并实施了一种能够检测网络范围内大量流量的新策略：结果表明，它可以实现比最先进的解决方案更好的准确性，同时依赖来自数据平面的更少信息，并且只导致边际额外的数据包处理时间。我们意识到提议的全网监控算法可能不会针对部分部署场景进行优化。然后，我们还在 P4 中开发并实施了一种能够检测网络范围内大量流量的新策略：结果表明，它可以实现比最先进的解决方案更好的准确性，同时依赖来自数据平面的更少信息，并且只导致边际额外的数据包处理时间。