On the use of traffic monitoring and measurements for improving networking

Several recent traffic monitoring studies proved that traffic is highly variable (sometimes not stationary), and in any cases exhibiting many disruptions in its throughput, that of course are damaging for providing a stable QoS. If some of these disruptions can be legitimate variations of traffic (because a user suddenly generates a big flow or because of a flash crowd), others may be due to DoS attacks. This paper presents the use of monitoring and measurement techniques for improving networking. In particular, it gives examples on how to operate TCP/IP level traffic engineering mechanisms, and how to use monitoring as a countermeasure for DoS attacks. All contribute to the provision and maintenance of end-to-end QoS in the presence of traffic disruptions, due to user demand (normal or abnormal) or to malicious behaviour.