[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Call for censensus on path forward

On Sat, 21 Sep 2002 20:18:34 +0900, Glenn Mansfield Keeni <glenn@cysols.com> said:
> a. Traffic graphs for a Gigabit network polled at, say, 1 minute
>     intervals are USELESS. What we end up seeing is the traffic
>     averaged over a minute! One never sees that real traffic
>     characteristics from these graphs. [Isn't there anyone out there
>     monitoring a high speed network ? I would be interested to know
>     how you do it.]

We poll every five minutes and make sure that those devices support
64-bit counters (if you think all Gigabit-capable router interfaces
support them, you'd be surprised).

I don't quite grasp the connection you make between network capacity
and polling intervals.  When I want to do analysis on the packet
level, then yes, on faster links packets will be shorter.  But then I
wouldn't use SNMP anyway but more suitable mechanisms such as port
copy/header traces or some kind of packet sampling.  In general,
high-speed links aggregate lots of microflows and I'm interested in
similar timescales than I would for slower links.  If anything,
microscopic traffic patterns are less of an issue on high-speed links
because queueing tends to be less visible in faster/more aggregated
parts of the network.

We do sometimes use a tool that polls a router's if[HC]{In,Out}Octets
counters every few seconds and displays them as an animated table.
But we notice that the interface counters (which are presumably in
some kind of ASIC) aren't exported to the SNMP agent all that often,
so intervals shorter than 5 or 10 seconds would give very weird
results on most platforms anyway.
Simon Leinen				       simon@babar.switch.ch
SWITCH				   http://www.switch.ch/misc/leinen/

	       Computers hate being anthropomorphized.