An Analytics Approach to Traffic Analysis in Network Virtualization Hui Zhang, Junghwan Rhee, Nipun Arora, Qiang Xu, Cristian Lumezanu, Guofei Jiang

Motivation 2  Challenges in virtual network trouble-shooting –Complex configurations –Miscellaneous network devices –Assorted traffic groups Multi-tenant Data Center An in-host network

FLOWVIEW Overview 3  FLOWVIEW is a tool for visualizing and analyzing OVS packet traces –Summarization (from individual events to packet traces) –Data reduction (trace categorization and clustering) –Analysis (visualization and comparative analysis)

Trace Slicing  A holistic view on the lifetime of a packet –a series of events collected from routers/switches that the packet goes through during its routing. –similar to IP Traceback output. 4 The snapshot of a FLOWVIEW slice example

Slice Features  FLOWVIEW defines three kinds of features on slices –Path features –Link features –Packet features 5 Path feature examples

Trace Analysis  Clustering of trace slices  Ranking of trace slices  Query of trace slices  Verification of trace slices 6 A ranking example

Implementation 7 Clustering based on slice features

Conclusion  FLOWVIEW is a tool for visualizing and analyzing data center network packet traces –individual trace events from hypervisors and switches are re-organized into trace slices that represent the life-time of packets. –offers versatile analytics features such as clustering, ranking, querying, verification as well as a graphical interface. 8

9