Tight bounds for Sketches in Traffic Validation

Forwarding fault detection increases the robustness of network connectivity by finding and allowing to react to faulty routers. One of the essential steps in forwarding fault detection is summarizing the observed traffic at different vantage points, so that the behavior of each monitored router can be assessed using a traffic validation function. This paper studies and characterizes 3 sketches (AGMS, Fast-AGMS and FastCount) as random variables in the given context. Sketches are traffic summary functions resilient to packet modification, creation and dropping that outperform sampling. By proposing a model for each sketch, we are able to define tighter bounds on the sketches' precision. That means we can choose smaller sketches, around one order of magnitude or more for given requirements on the precision the sketch, typically in the range of tens of KB, saving memory and network bandwidth in the detection of faulty routers.