Toward Composable Network Traffic Measurement

International audienceWe present Blockmon, a composable measurement system designed to enable measurement of ever larger and more diverse networks, to cope with the ever-continuing growth of the Internet. Blockmon combines the flexibility that allows for a w de range of traffic monitoring and data analysis with the necessary mechanisms to yield high performance on today's modern multi-core hardware. We present the design of the system, focusing on the mechanisms that enable this flexibility and performance. We present experimental results demonstrating Blockmon's performance, running simple analyses at 10Gb/s line rate without loss on low-cost commodity hardware; and compare its performance with that of existing programmable measurement systems, showing significant improvement especially for small packet sizes. We further demonstrate Blockmon's applicability to measurement and data analysis by implementing and evaluating three sample applications: a flow meter, a TCP SYN flood detector, and a VoIP anomaly-detection system. Blockmon is available under the BSD license