[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Call for censensus on path forward

Simon Leinen wrote:
> On Sat, 21 Sep 2002 20:18:34 +0900, Glenn Mansfield Keeni <glenn@cysols.com> said:
>>a. Traffic graphs for a Gigabit network polled at, say, 1 minute
>>    intervals are USELESS. What we end up seeing is the traffic
>>    averaged over a minute! One never sees that real traffic
>>    characteristics from these graphs. [Isn't there anyone out there
>>    monitoring a high speed network ? I would be interested to know
>>    how you do it.]
> We poll every five minutes and make sure that those devices support
> 64-bit counters (if you think all Gigabit-capable router interfaces
> support them, you'd be surprised).
> I don't quite grasp the connection you make between network capacity
> and polling intervals.  When I want to do analysis on the packet
> level, then yes, on faster links packets will be shorter.  But then I
> wouldn't use SNMP anyway but more suitable mechanisms such as port
> copy/header traces or some kind of packet sampling.  In general,
> high-speed links aggregate lots of microflows and I'm interested in
> similar timescales than I would for slower links.  If anything,
> microscopic traffic patterns are less of an issue on high-speed links
> because queueing tends to be less visible in faster/more aggregated
> parts of the network.

By polling at 5 minute intervals you will not find any of the peaks
(bytes or packets) in the traffic. As the network capacity increases
the number of peaks and troughs increase.
> We do sometimes use a tool that polls a router's if[HC]{In,Out}Octets
> counters every few seconds and displays them as an animated table.
> But we notice that the interface counters (which are presumably in
> some kind of ASIC) aren't exported to the SNMP agent all that often,
> so intervals shorter than 5 or 10 seconds would give very weird
> results on most platforms anyway.

Yes there ARE weird implementation and as yet SNMP implementation
quality is not a major criteria for selecting devices. But the work
around is to use passive monitors. We use passive monitors for polling.
These give reasonably accurate results even at millisec intervals (using