Implementation and Evaluation of a Protocol for Detecting Network-Wide Threshold Crossing Alerts

Threshold crossing alerts (TCAs) indicate to a management system that a management variable, associated with the state, performance or health of the network, has crossed a certain threshold. In this paper, we report on implementing and evaluating TCA-GAP, a distributed protocol for detecting network-wide TCAs, which reports threshold crossings on aggregates, such as SUM, AVERAGE, or MAX of device counters. We present a concept for assessing the quality of detecting network-wide TCAs, which we apply to evaluate TCA-GAP on a lab testbed. First, we evaluate the correctness of the protocol by determining the correctly detected threshold crossings, the false positives and the false negatives. Second, for the correctly detected threshold crossings, we measure the delays between the time a crossing was reported by the protocol and the time of its actual occurrence. Finally, we demonstrate that the fundamental tradeoff between the quality of TCA detection and the management overhead can be controlled in TCA-GAP by modifying the maximum message rate on the management overlay.