FlowStalker: Comprehensive Traffic Flow Monitoring on the Data Plane using P4

Programmability has been extensively investigated to enable a more flexible operation of computer networks, and in this context the P4 language was designed entirely for programming the data plane. With programmable data planes comes the possibility of revisiting many inefficient approaches to networking problems, for example how we use the data plane to create an understanding of the network state. Traditional switches expose only a bare minimum of what happens in their forwarding plane, forcing us to resort to inefficient methods, such as snapshotting, to acquire the state of the network. We advocate that by combining the programmable hardware on switches with every switch specific view over its traffic, we are able to accomplish the same tasks in a more efficient and comprehensive manner. In this paper we present an efficient monitoring mechanism using programmable data planes. Our mechanism capitalizes on data plane programmability to perform tasks that are usually performed solely by the control plane (e.g. traffic monitoring and information gathering). Firstly, we present a monitoring system based on a two-phase monitoring scheme that runs directly on the data plane. Secondly, we introduce a flexible method for network data gathering, enabling “control-plane-free” consolidation of data from switches. Finally, we show techniques for using both the monitor and the gathering system to create constant, snapshot-free analysis of network traffic.