The ability to observe and make sense of network traffic is a persistent and well-established requirement for effective administration of performant and secure networks. Over the last ten years, the capabilities as well as the needs and requirements of monitoring network traffic have undergone considerable evolution sparking numerous research efforts. Three historically distinct background areas fundamentally shape this evolution: network monitoring system design, applications of programmable switch hardware, and in-network aggregation methods. An emergent body of research leverages aspects from all three of these background areas to develop systems that collect more detailed, precise traffic insights while simultaneously realizing order of magnitude improvements in traffic processing efficiency.

Given the increasing activity and potential for high impact, we focus on this emergent direction of research in traffic monitoring using programmable switch hardware for in-network aggregation. The three background areas whose intersection defines this research direction provide natural and intuitive dimensions along which each new work can be classified. We leverage these dimensions to construct a hierarchical taxonomy which groups efforts by types of network monitoring tasks considered, specifications and shapes of aggregation computations involved, and types of processing platforms targeted. For each sub-group implied by our taxonomy, we discuss common approaches, key contributions, and open problems apparent across works in that sub-group. Finally we reflect on open problems more generally across all groups proposing three concrete directions for future research.