  Networks are difficult to configure correctly, and tricky to debug. These
problems are accentuated by temporal and stateful behavior. Static
verification, while useful, is ineffectual for detecting behavioral deviations
induced by hardware faults, security failures, and so on, so dynamic property
monitoring is also valuable. Unfortunately, existing monitoring and runtime
verification for networks largely focuses on properties about individual
packets (such as connectivity) or requires a digest of all network events be
sent to a server, incurring enormous cost.
  We present a network monitoring system that avoids these problems. Because
traces of network events correspond well to temporal logic, we use a subset of
Metric First-Order Temporal Logic as the query language. These queries are
compiled down to execute completely on the network switches. This vastly
reduces network load, improves the precision of queries, and decreases
detection latency. We show the practical feasibility of our work by extending a
widely-used software switch and deploying it on networks. Our work also
suggests improvements to network instruction sets to better support temporal
monitoring.
