Ten academic papers to understand network monitoring

Ten academic papers to understand network monitoring

Network monitoring is essential to assure maximum use of services and applications, especially scientific ones, and to support efficient diagnosis and troubleshooting of performance problems.

The Brazilian National Research and Educational Network (RNP) uses the perfSONAR open platform, an international standard for measuring IP network performance, and offers the academic community the e-Ciência MonIpê service, which allows the measurement of network performance and quality using distributed measurement spots. The results of the measurements are then stored and made available for queries.

Researchers from several academic institutions in Brazil are part of the Technical Committee for Network Monitoring (CT-Mon), coordinated by the RNP and whose main objective is to follow developments in monitoring, seek technological solutions and present recommendations to the RNP.

One of the purposes of the CT-Mon is to stimulate the production of knowledge on network monitoring and measurement. With that in mind, the group has selected 10 historically-relevant articles that helped shape and consolidate academic production in the area, influencing several other subsequent works. See them below:

Bolot presented a groundbreaking study that evaluated network performance using a simple and elegant analysis of packet delay, bandwidth, packet size and loss.

Bolot, J.-C. (1993). End-to-end packet delay and loss behavior the Internet. In Proc. of the ACM pages 289–298, San Francisco, CA, USA.

The sequence of studies below showed, based on measurements, that local area network traffic, wide area network traffic and WWW traffic presented, respectively, self-similarity characteristics. They were instrumental to the understanding of traffic nature under different perspectives, signaling the need for new models for that traffic, and promoting the importance of network measurements for more realistic studies.

Leland, W. E., Taqqu, M. S., Willinger, W., and Wilson, D. V. (1994). On the self-similar nature of Ethernet traffic. IEEE/ACM Transactions on Networking, 2(1):1-15.

Paxson, V. and Floyd, S. (1995). Wide area traffic: The failure of Poisson modeling. IEEE/ACM Transactions on Networking, 3(3):226–244.

Crovella, M. E. and Bestavros, A. (1997). Self-similarity in World Wide Web traffic: evidence and possible causes. IEEE/ACM Transactions on Networking, 5(6):835–846.

Paxon investigated the dynamics of Internet packets traffic by taking measurements at different spots and, most importantly, showing how the real traffic observed differed from the established models. That was a seminal work that greatly contributed to the establishment and consolidation of the Network Metrics field as a methodology for the study of Internet performance.

Paxson, V. (1997). End-to-end Internet packet dynamics. In Proc. of the ACM SIGCOMM, pages 139–152, Cannes, France.

The Faloutsos Brothers showed in [6] that the Internet topology presented scale-free charactertistics, revealing properties that impact network performance.

Faloutsos, M., Faloutsos, P., and Faloutsos, C. (1999). On power-law relationships of the Internet topology. In Proc. of the ACM SIGCOMM, pages 251–262, Cambridge, MA, USA.


Spring et. Al. introduced new techniques for mapping topologies of Internet service provider networks, which allowed for the discovery of realistic topologies using a significantly smaller number of measurements.

Spring, N., Mahajan, R., and Wetherall, D. (2002). Measuring ISP with Rocketfuel. In Proc. of the ACM SIGCOMM, pages 133–145, Pittsburgh, PA, USA.


Prasad et al. consolidated, in this research, knowledge regarding tools for estimating bandwidth in its different forms: nominal capacity, bandwidth and ability to transfer large volumes of data.

Prasad, R., Dovrolis, C., Murray, M., and Claffy, K. (2003). Bandwidth estimation: metrics, measurement techniques, and tools. IEEE Network, 17(6):27–35.

Lakhina et al. introduced new methods for diagnosing (i.e., detecting, identifying and quantifying) anomalies in traffic volume. 

Lakhina, A., Crovella, M., and Diot, C. (2004). Diagnosing network-wide traffic anomalies. In Proc. of the ACM SIGCOMM, pages 219–230, Portland, Oregon, USA.


Karagiannis et al. proposed a new approach for the efficient classification of traffic flows, based on the applications by which they were generated. In contrast to previous methods, this proposal was based on the observation and identification of traffic behavior patterns at the transport layer.

Karagiannis, T., Papagiannaki, K., and Faloutsos, M. (2005). Blinc: Multilevel traffic classification in the dark. In Proc. of the ACM SIGCOMM, pages 229–240, Philadelphia, PA, USA.