PCANT: Programmable Capture and Analysis of Network Traffic

The rapid proliferation of heterogeneous devices, complex network architectures and distributed services leads to a growing demand for monitoring solutions. Focusing on solutions that analyze traffic data to monitor devices and applications, we observe that measurements and analytics are rarely tailored to the specifics of the service they monitor. The difficulty of creating ad-hoc solutions is not only due to the diversity of devices and applications, but also to the difficulty of deploying such features: acquiring the right data for a new monitoring need requires manually configuring the different network equipment to extract this data. Without this, monitoring is constrained to a fixed set of input features. In this paper, we present and demonstrate a novel platform for network traffic monitoring that removes this limitation: the Programmable Capture and Analysis of Network Traffic (PCANT) platform. It allows network administrators to dynamically deploy new monitoring functions with no manual intervention inside the network. On demand, it automatically installs arbitrary data acquisition methods in network equipment, instantiates analysis functions in a dedicated compute node, and manages the data transmission between the two. Monitoring functions can thus be implemented by data analysts with limited networking knowledge, and deployed at no cost.