{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,20]],"date-time":"2026-03-20T15:51:17Z","timestamp":1774021877081,"version":"3.50.1"},"reference-count":41,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2019,2,20]],"date-time":"2019-02-20T00:00:00Z","timestamp":1550620800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["SIGCOMM Comput. Commun. Rev."],"published-print":{"date-parts":[[2019,2,20]]},"abstract":"<jats:p>Network telemetry is about understanding what is happening in the current network. It serves as the basis for making a variety of management decisions for improving the performance, availability, security, and efficiency of networks. However, it is challenging to build real-time and fine-grained network telemetry systems because of the need to support a variety of measurement queries, handle a large amount of traffic for large networks, while staying within the resource constraints at hosts and switches. Today, most operators take a bottom-up approach by passively collecting data from individual devices and infer the network-wide information they need. They are often limited by the monitoring tools device vendors provide and find it hard to extract useful information. In this paper, we argue for a top-down approach: We should provide a high-level declarative abstraction for operators to specify measurement queries, programmable measurement primitives at switches and hosts, and a runtime that translates the high-level queries into low-level API calls. We discuss a few recent works taking this top-down approach and call for more research in this direction.<\/jats:p>","DOI":"10.1145\/3314212.3314215","type":"journal-article","created":{"date-parts":[[2019,2,22]],"date-time":"2019-02-22T17:01:44Z","timestamp":1550854904000},"page":"11-17","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":57,"title":["Network telemetry"],"prefix":"10.1145","volume":"49","author":[{"given":"Minlan","family":"Yu","sequence":"first","affiliation":[{"name":"Harvard University"}]}],"member":"320","published-online":{"date-parts":[[2019,2,20]]},"reference":[{"key":"e_1_2_1_1_1","unstructured":"www.marketsandmarkets.com\/PressReleases\/network-analytics.asp.  www.marketsandmarkets.com\/PressReleases\/network-analytics.asp."},{"key":"e_1_2_1_2_1","unstructured":"netsil.com.  netsil.com."},{"key":"e_1_2_1_3_1","unstructured":"www.pluribusnetworks.com.  www.pluribusnetworks.com."},{"key":"e_1_2_1_4_1","unstructured":"www.logicmonitor.com.  www.logicmonitor.com."},{"key":"e_1_2_1_5_1","unstructured":"www.cisco.com\/en\/US\/products\/ps6601\/products_ios_protocol_group_home.html.  www.cisco.com\/en\/US\/products\/ps6601\/products_ios_protocol_group_home.html."},{"key":"e_1_2_1_6_1","unstructured":"datatracker.ietf.org\/wg\/syslog\/charter\/.  datatracker.ietf.org\/wg\/syslog\/charter\/."},{"key":"e_1_2_1_7_1","unstructured":"www.web10g.org.  www.web10g.org."},{"key":"e_1_2_1_8_1","unstructured":"p4.org.  p4.org."},{"key":"e_1_2_1_9_1","unstructured":"www.cisco.com\/en\/US\/docs\/internetworking\/technology\/handbook\/SNMP.html.  www.cisco.com\/en\/US\/docs\/internetworking\/technology\/handbook\/SNMP.html."},{"key":"e_1_2_1_10_1","unstructured":"Azure network watcher. azure.microsoft.com\/en-us\/blog\/announcing-azure-network-watcher-network-performance-monitoring-and-diagnostics-service-for-azure.  Azure network watcher. azure.microsoft.com\/en-us\/blog\/announcing-azure-network-watcher-network-performance-monitoring-and-diagnostics-service-for-azure."},{"key":"e_1_2_1_11_1","unstructured":"Big monitoring fabric. www.bigswitch.com\/products\/big-monitoring-fabric.  Big monitoring fabric. www.bigswitch.com\/products\/big-monitoring-fabric."},{"key":"e_1_2_1_12_1","unstructured":"https:\/\/aws.amazon.com\/blogs\/security\/tag\/network-monitoring-tools\/.  https:\/\/aws.amazon.com\/blogs\/security\/tag\/network-monitoring-tools\/."},{"key":"e_1_2_1_13_1","unstructured":"Arbor Networks. Insight Into the Global Threat Landscape. goo.gl\/15oOx3 February 2013.  Arbor Networks. Insight Into the Global Threat Landscape. goo.gl\/15oOx3 February 2013."},{"key":"e_1_2_1_14_1","volume-title":"NSDI","author":"Arzani B.","year":"2018"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/1282380.1282382"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/2670518.2673872"},{"key":"e_1_2_1_17_1","volume-title":"The Internet as a Large-Scale Complex System","author":"Grossglauser M.","year":"2005"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/2785956.2787496"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3230543.3230555"},{"key":"e_1_2_1_20_1","volume-title":"NSDI","author":"Handigol N.","year":"2014"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/2486001.2486019"},{"key":"e_1_2_1_22_1","volume-title":"NSDI","author":"Li Y.","year":"2016"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/2934872.2934906"},{"key":"e_1_2_1_24_1","volume-title":"NSDI","author":"Monsanto C.","year":"2013"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/2619239.2626291"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/2934872.2934879"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3098822.3098829"},{"key":"e_1_2_1_29_1","volume-title":"NSDI","author":"Narayana S.","year":"2016"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/2619239.2626310"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/2785956.2787472"},{"key":"e_1_2_1_32_1","volume-title":"NSDI","author":"Roy A.","year":"2017"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879186"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/2785956.2787508"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/2619239.2626298"},{"key":"e_1_2_1_36_1","volume-title":"NSDI","author":"Tammana P.","year":"2018"},{"key":"e_1_2_1_37_1","volume-title":"NSDI","author":"Tilmans O.","year":"2018"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/1592568.1592604"},{"key":"e_1_2_1_39_1","volume-title":"International Conference on, 0: 628--635","author":"Wang M.","year":"2004"},{"key":"e_1_2_1_40_1","volume-title":"NSDI","author":"Yu M.","year":"2011"},{"key":"e_1_2_1_41_1","volume-title":"NSDI","author":"Yu M.","year":"2013"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/2785956.2787483"}],"container-title":["ACM SIGCOMM Computer Communication Review"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3314212.3314215","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3314212.3314215","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T23:53:22Z","timestamp":1750204402000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3314212.3314215"}},"subtitle":["towards a top-down approach"],"short-title":[],"issued":{"date-parts":[[2019,2,20]]},"references-count":41,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2019,2,20]]}},"alternative-id":["10.1145\/3314212.3314215"],"URL":"https:\/\/doi.org\/10.1145\/3314212.3314215","relation":{},"ISSN":["0146-4833"],"issn-type":[{"value":"0146-4833","type":"print"}],"subject":[],"published":{"date-parts":[[2019,2,20]]},"assertion":[{"value":"2019-02-20","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}