Discovering the Structure of Cloud Applications Using Sampled Packet Traces

Accurate and up-to-date knowledge of how a cloud tenant's VMs utilize the underlying cloud infrastructure is essential for many cloud management tasks including tenant onboarding, optimized VM placement, performance optimization, and debugging. Unfortunately, existing solutions such as instrumentation at the hypervisors or standard networking protocols such as LLDP only provide a partial picture of cloud tenant's application structures and how they stress the underlying infrastructure. In this paper, we consider whether it is possible to use sFlow, a standardized mechanism for packet header sampling available in most commodity network switches, to extract such information in an accurate and scalable manner. We overcome the challenges posed by the purely passive and highly sampled nature of sFlow data, and describe a tool, sFinder, that automatically and continuously extracts such information. Our evaluation using sampled sFlow data from a real private cloud show that sFinder is accurate and efficient.