Network Measurements课件.ppt

Example: Passive site border monitoring Use Cisco Netflow in Catalyst 6509 with MSFC, on SLAC border Gather about 200MBytes/day of flow data The raw data records include source and destination addresses and ports, the protocol, packet, octet and flow counts, and start and end times of the flows Much less detailed than saving headers of all packets, but good compromise Top talkers history and daily (from to), tlds, vlans, protocol and application utilization Use for network security 精品文档 Simplified SLAC DMZ Network, 2001 swh-root Swh-dmz rtr-msfc-dmz ESnet Stanford Internet2 OC12 link 622Mbps 155Mbps OC3 link(*) SLAC Internal Network (*) Upgrade to OC12 has been requested (#) This link will be replaced with a OC48 POS card for the 6500 when available Etherchannel 4 gbps 10Mbps Ethernet 1Gbps Ethernet NTON 2.4Gbps OC48 link (#) 100Mbps Ethernet Dial up ISDN 精品文档 SLAC Traffic profile SLAC offsite links: OC3 to ESnet, 1Gbps to Stanford U thence OC12 to I2 OC48 to NTON Profile bulk-data xfer dominates SSH FTP HTTP Mbps in Mbps out Last 6 months 2 Days bbftp iperf 精品文档 Top talkers by protocol Hostname MBytes/day (log scale) 100 1 10000 Volume dominated by single Application - bbftp 精品文档 Time series UDP TCP Outgoing Incoming Cat 4000 802.1q vs. ISL 精品文档 Flow sizes Heavy tailed, in ~ out, UDP flows shorter than TCP, packet~bytes 75% TCP-in 5kBytes, 75% TCP-out 1.5kBytes (10pkts) UDP 80% 600Bytes (75% 3 pkts), ~10 * more TCP than UDP Top UDP = AFS (55%), Real(~25%), SNMP(~1.4%) SNMP Real A/V AFS file server 精品文档 Power law fit parameters by time Just 2 parameters provide a reasonable description of the flow size distributions 精品文档 Flow lengths Distribution of netflow lengths for SLAC border Log-log plots, linear trendline = power law Netflow ties off flows after 30 minutes TCP, UDP ICMP “flows” are ~log-log linear for longer (hundreds to 1500 seconds) flows (heavy-tails) There are some peaks in TCP distributions, timeouts? Web server CGI script timeouts