Clock-synchronized edge-based network functions

A non-transitory computer-readable medium comprising memory with instructions encoded thereon for monitoring for anomalies in network traffic, the instructions, when executed by one or more processors, comprising instructions to:

• for a data flow transmitted between a sender host and a receiver host:
• record, on a first rolling basis, by the sender host, a first pre-defined amount of sent network traffic of the data flow;
• and record, on a second rolling basis, by the receiver host, a second pre-defined amount of received network traffic of the data flow, wherein the sender host and the receiver host are clock-synchronized;
• monitor for an anomaly in the data flow based on time stamps of data packets in the network traffic;
• determine whether an anomaly is detected during the monitoring;
• responsive to determining that no anomaly is detected during the monitoring, overwrite the recorded sent network traffic and the recorded received network traffic with newly sent network traffic and newly received network traffic, respectively;
• and responsive to determining that an anomaly is detected during the monitoring, pause the data flow, causing the sender host to store the recorded sent network traffic to a first buffer, and causing the receiver host to store the recorded received network traffic to a second buffer, wherein determining that the anomaly is detected during the monitoring comprises determining that a one-way delay of a data packet sent by the sender host to the receiver host exceeds a threshold amount of delay, wherein the one-way delay is determined using a send time stamp applied by the sender host to data packets of the data flow as compared to a receive time stamp applied by the receiver host to the data packets, wherein the sender host and the receiver host are synchronized to a same reference clock, and wherein the send time stamp and the receive time stamp are based on the same reference clock.