Multi‐granular, multi‐purpose and multi‐Gb/s monitoring on off‐the‐shelf systems

SUMMARY As an attempt to make network managers’ life easier, we present M 3 Omon , a system architecture that helps to develop monitoring applications and perform network diagnosis. M 3 Omon behaves as an intermediate layer between the traffic and monitoring applications that provides advanced features, high performance and low cost. Such advanced features leverage a multi‐granular and multi‐purpose approach to the monitoring problem. Multi‐granular monitoring provides answers to tasks that use traffic aggregates to identify an event, and requires either flow records or packet data or even both to understand it and, eventually, take convenient countermeasures. M 3 Omon provides a simple API to access traffic simultaneously at several different granularities, i.e. packet‐level, flow‐level and aggregate statistics. The multi‐purposed design of M 3 Omon allows not only performing tasks in parallel that are specifically targeted to different traffic‐related purposes (e.g. traffic classification and intrusion detection) but also sharing granularities between applications, e.g. several concurrent applications fed from flow records that are provided by M 3 Omon . Finally, the low‐cost characteristic is brought by off‐the‐shelf systems (the combination of open‐source software and commodity hardware) and the high performance is achieved thanks to modifications in the standard NIC driver, low‐level hardware interaction, efficient memory management and programming optimization.