  OpenFlow is a protocol implementing Software Defined Networking, a new
networking paradigm, which segregates packet forwarding and accounting
(performed on switches) from the routing decisions and advanced protocols
(executed on a central controller). This segregation increases agility and
flexibility of a networking infrastructure and reduces its operational
expenses. OpenFlow controllers expose standard interfaces to facilitate variety
of networking applications. In particular, a monitoring application can use
these interfaces to push into the OpenFlow switches rules that collect traffic
flow statistics at different aggregation levels. The aggregation level
determines the monitoring accuracy and the induced network overhead. In this
paper, we propose Floware an OpenFlow application that allows discovery and
monitoring of active flows at any required aggregation level. Floware balances
the monitoring overhead among many switches in order to reduce its negative
effect on network performance. In addition, Floware integrates with monitoring
systems based on legacy protocols such as NetFlow. We demonstrate the
application with soft switches emulated in Mininet, the Floodlight controller,
and the NetFlow Analyzer as a legacy network analysis and intrusion detection
system. Evaluation results demonstrate the positive impact of balanced
monitoring.
