A Probabilistic In-band network Telemetry CHeckER (PITCHER)
Abstract
Because of their heterogeneous, decentralized and layered architecture, computer networks are very difficult to debug. To make matters worse, small anomalies can often cause widespread connection outages, security breaches, and millions of dollars of lost revenues. To investigate network problems, operators often turn to network telemetry, a technique that consists of gathering remote network state. Existing telemetry tools, however, are either too coarse-grained, or too space-inefficient. Traditional debugging tools such as traceroute, ping, SNMP or Sflow, for example, are unable to investigate the causes of fleeting phenomena such as microbursts, or intermittent packet drops. On the other hand of the spectrum, fine-grained telemetry frameworks such as INT [1], allow network administrators to inspect a network down to an unprecedented level of detail. These tools can record metric information about each device every time that a packet passes through it. However, this means producing massive quantities of reports, which can overwhelm the node(s) responsible for collecting the telemetry information, and it can make real-time analysis of the data unfeasible. The goal of this project is to design a real-time telemetry software (PITCHER), with an accuracy that is comparable to the INT framework, and a greatly reduced reporting rate. In particular, the proposed solution will aim to render the INT collectors capable of automatically filtering redundant or irrelevant telemetry information out, and reporting only the data pointing to some new network event. PITCHER will be useful to network operators, data-center administrators, and internet service providers to perform real-time network monitoring.
