Measuring change in large enterprise data networks

In the management of large enterprise data communication networks, it is difficult to discern the causes of abnormal variations in traffic distributions on the physical network because the underlying logical topology can be very dynamic. This paper uses several graph distance measures to explore whether abnormal changes in logical connectivity and traffic flows can be detected in a sample of real network traffic. Traffic parameters were collected from a network probe attached to a physical link within a large enterprise data network. Localisation techniques were also examined to show where in the logical network most changes occurred.