[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Call for censensus on path forward



Simon Leinen wrote:
> On Sat, 21 Sep 2002 20:18:34 +0900, Glenn Mansfield Keeni <glenn@cysols.com> said:
> 
>>a. Traffic graphs for a Gigabit network polled at, say, 1 minute
>>    intervals are USELESS. What we end up seeing is the traffic
>>    averaged over a minute! One never sees that real traffic
>>    characteristics from these graphs. [Isn't there anyone out there
>>    monitoring a high speed network ? I would be interested to know
>>    how you do it.]
> 
> 
> We poll every five minutes and make sure that those devices support
> 64-bit counters (if you think all Gigabit-capable router interfaces
> support them, you'd be surprised).
> 
> I don't quite grasp the connection you make between network capacity
> and polling intervals.  When I want to do analysis on the packet
> level, then yes, on faster links packets will be shorter.  But then I
> wouldn't use SNMP anyway but more suitable mechanisms such as port
> copy/header traces or some kind of packet sampling.  In general,
> high-speed links aggregate lots of microflows and I'm interested in
> similar timescales than I would for slower links.  If anything,
> microscopic traffic patterns are less of an issue on high-speed links
> because queueing tends to be less visible in faster/more aggregated
> parts of the network.

By polling at 5 minute intervals you will not find any of the peaks
(bytes or packets) in the traffic. As the network capacity increases
the number of peaks and troughs increase.
> 
> We do sometimes use a tool that polls a router's if[HC]{In,Out}Octets
> counters every few seconds and displays them as an animated table.
> But we notice that the interface counters (which are presumably in
> some kind of ASIC) aren't exported to the SNMP agent all that often,
> so intervals shorter than 5 or 10 seconds would give very weird
> results on most platforms anyway.

Yes there ARE weird implementation and as yet SNMP implementation
quality is not a major criteria for selecting devices. But the work
around is to use passive monitors. We use passive monitors for polling.
These give reasonably accurate results even at millisec intervals (using
aggregation).

Glenn