Combinational Monitoring

2.2.3 Combinational Monitoring
After reading the sections above one can safely come to the conclusion that a combination of active and passive monitoring is
better than using one or the other. Combinational techniques utilize the best aspects of both passive and active monitoring
environments. Two newly introduced combinational monitoring techniques are described below. Watching Resources from the
Edge of the Network (WREN) and Self-Configuring Network Monitor (SCNM).
2.2.3.1 Watching Resources from the Edge of the Network (WREN)
WREN [LowekampZangrilli04] uses a combination of active and passive monitoring techniques by actively monitoring when
traffic is low and passively monitoring during high traffic times. It monitors traffic at both the source and destination end host
which allows for more accurate measurements. WREN uses packet traces from existing application traffic to measure the available
bandwidth. WREN is split into two levels, the kernel level packet trace facility and the user level trace analyzer.
The kernel level packet trace facility is responsible for capturing the information associated with incoming and outgoing packet.
Figure 6 lists the information that is gathered for each packet. A buffer was added to the Web100 kernel to collect these
characteristics. Access to the buffer is through 2 system calls. One call starts the trace and provides the information needed to
conduct it while another call retrieves the trace from the kernel.