Abstract
Continuous monitoring of a network domain poses several challenges. First, routers of a network domain
need to be polled periodically to collect statistics about delay, loss, and bandwidth. Second, this huge amount of data has to be mined to obtain useful monitoring information. This increases the overhead for high speed core routers, and restricts the monitoring process from scaling to a large number of flows. To achieve
scalability, polling and measurements that involve core routers should be avoided. We design and evaluate a
distributed monitoring scheme that uses only edge-to-edge measurements, and scales well to large network
domains. In our scheme, all edge routers form an overlay network with their neighboring edge routers.
The network is probed intelligently from nodes in the overlay to detect congestion in both directions of a
link. The proposed scheme requires significantly fewer number of probes than existing monitoring schemes.
Through analytic study and a series of experiments, we show that the proposed scheme can effectively identify the congested links. The congested links are used to capture the misbehaving flows that are violating their service level agreements, or attacking the domain by injecting excessive traffic.
