Toward Unified Network Traffic Monitoring Using SIR
Modern network management requires dynamically reacting to a broad set of events occurring in the network. Detecting the traffic behaviors associated with these events requires identifying patterns and computing metrics over high-velocity streams of network packets flowing through a link, router, or switch. To facilitate performing computations, a number of traffic query languages have been proposed in the network systems community. However, existing traffic query languages primarily focus on expressing computations that can be efficiently implemented on particular hardware or software platforms (such as programmable switch ASICs or multi-core CPUs) and do not support the full range of behaviors required by modern network management tasks. For example, languages like Sonata efficiently support count-based metrics on switch ASICs, but fail to support complex inter-packet pattern identification, whereas a language like FLM can identify patterns on switch ASICs but cannot compute quantitative metrics. In this paper, we argue that an ideal traffic query language should give network operators flexibility to detect a diversity of events without sacrificing implementation efficiency. To create such a language, two key challenges must be overcome: 1) understanding the variety and differences of existing query languages and 2) efficiently using the available resources to execute those queries. As an initial step towards addressing these challenges, we present a stream processing model called Streaming Intermediate Representation (SIR), which can represent a wide range of queries while providing bounds on the resource usage required for efficient implementations. We demonstrate the generality of the model by building compilers from three representative query languages into SIR. We also outline a framework for reasoning about the resource usage of queries represented in SIR and present the analysis of example queries compiled into SIR from different query languages.