1. An Analytics Approach to Traffic Analysis in Network Virtualization Hui Zhang, Junghwan Rhee, Nipun Arora, Qiang Xu, Cristian Lumezanu, Guofei Jiang www.nec-labs.com

2. Motivation 2  Challenges in virtual network trouble-shooting –Complex configurations –Miscellaneous network devices –Assorted traffic groups Multi-tenant Data Center An in-host network

3. FLOWVIEW Overview 3  FLOWVIEW is a tool for visualizing and analyzing OVS packet traces –Summarization (from individual events to packet traces) –Data reduction (trace categorization and clustering) –Analysis (visualization and comparative analysis)

4. Trace Slicing  A holistic view on the lifetime of a packet –a series of events collected from routers/switches that the packet goes through during its routing. –similar to IP Traceback output. 4 The snapshot of a FLOWVIEW slice example

5. Slice Features  FLOWVIEW defines three kinds of features on slices –Path features –Link features –Packet features 5 Path feature examples

6. Trace Analysis  Clustering of trace slices  Ranking of trace slices  Query of trace slices  Verification of trace slices 6 A ranking example

7. Implementation 7 Clustering based on slice features

8. Conclusion  FLOWVIEW is a tool for visualizing and analyzing data center network packet traces –individual trace events from hypervisors and switches are re-organized into trace slices that represent the life-time of packets. –offers versatile analytics features such as clustering, ranking, querying, verification as well as a graphical interface. 8

9. 9 www.nec-labs.com