[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Call for censensus on path forward

Simon Leinen wrote:

On Sat, 21 Sep 2002 20:18:34 +0900, Glenn Mansfield Keeni <glenn@cysols.com> said:


a. Traffic graphs for a Gigabit network polled at, say, 1 minute
   intervals are USELESS. What we end up seeing is the traffic
   averaged over a minute! One never sees that real traffic
   characteristics from these graphs. [Isn't there anyone out there
   monitoring a high speed network ? I would be interested to know
   how you do it.]


We poll every five minutes and make sure that those devices support
64-bit counters (if you think all Gigabit-capable router interfaces
support them, you'd be surprised).

I don't quite grasp the connection you make between network capacity
and polling intervals.  When I want to do analysis on the packet
level, then yes, on faster links packets will be shorter.  But then I
wouldn't use SNMP anyway but more suitable mechanisms such as port
copy/header traces or some kind of packet sampling.  In general,
high-speed links aggregate lots of microflows and I'm interested in
similar timescales than I would for slower links.  If anything,
microscopic traffic patterns are less of an issue on high-speed links
because queueing tends to be less visible in faster/more aggregated
parts of the network.

By polling at 5 minute intervals you will not find any of the peaks
(bytes or packets) in the traffic. As the network capacity increases
the number of peaks and troughs increase.

We do sometimes use a tool that polls a router's if[HC]{In,Out}Octets
counters every few seconds and displays them as an animated table.
But we notice that the interface counters (which are presumably in
some kind of ASIC) aren't exported to the SNMP agent all that often,
so intervals shorter than 5 or 10 seconds would give very weird
results on most platforms anyway.

Yes there ARE weird implementation and as yet SNMP implementation
quality is not a major criteria for selecting devices. But the work
around is to use passive monitors. We use passive monitors for polling.
These give reasonably accurate results even at millisec intervals (using
aggregation).

Glenn