talled in the network-wide in order to minimize the space taken on the switch flow tables. Finally, the third component pre- pares the data for anomaly detection applications, which will use these data. It anecdotes the data with the corresponding spatial/temporal aggregation information, which describes the accuracy of the data. 4.4.2 Network Measurement In data center and Internet service provider (ISP) networks where operators own the entire network, monitoring on each device (i.e., a host or switch) should no longer be treated separately. To fully 4.4 SDN Management leverage the different views of traffic and different capabilities in mon- itoring different flow properties across devices, it becomes important to run coordinated measurements across different devices. For example, an ingress switch is a better place to measure per source traffic, while an egress is better at measuring per destination traffic. A host can monitor packet losses by collecting TCP-level statistics or packet-level traces, while switches can more easily measure the traffic through a network path. Both hosts and switches have resource constraints when run- ning these measurement tasks. Hosts need to devote most of their resources to the revenue-generating applications, leaving fewer pro- cessing resources for measurement. Switches have limited memory to store measurement data from all flows. Temporal coordination of measurement across devices can signifi- cantly reduce measurement overhead. For example, we only need to start monitoring the per-flow volume at every hop of a path when we observe end-to-end anomalies at hosts (e.g., unexpected large flows, unexpected packet losses). Another example is diagnosing equal cost multi-path (ECMP) hashing problems. Rather than continuously mon- itoring all the flows at all the ECMP paths, we only need to start mon- itoring the flows whose traffic across any of the paths becomes large. Given the resource limitations at individual hosts and switches, instead of monitoring all the flows all the tim