• Welcome -- Ken Miller
• Internet2 Update -- Jeff Boote
• Performance Portal Preview (design, privacy considerations, etc.) - Jeff and Aaron
see performance portal slides at: http://www.internet2.edu/presentations/spring12/20120423-boote-perfportal.ppt
• Using mock data currently
• Call for participation to discuss operation and data privacy
• WAN Metrics Project at PSU (including financial angles of network measurement) – Ken
see WAN Metrics Project slides at: http://www.internet2.edu/presentations/spring12/20120423-miller-psu-wan-metrics.pdf
• Software Defined Networking / Open Flow - Group Inquiry
• How do we measure openflow and the controllers?
• A few people are running OpenFlow in test
• Question from NYU about measuring openflow on layer 2 and layer 3.
• Stanford wrote some software that will provide some measurements.
• Reminder of The Challenge - Ken
• Community Updates / Open Forum
• Question if anyone is doing sub-second polling to capture microbursts of traffic. Some responded that that's too often, a packet capture would be better. Other responded that they are polling a various intervals. Some said 5 min, 1 min, 15 seconds, but it all depends on if the hardware would handle it. Also the device counters update frequency will need to be adjusted.
•
What kinds of network measurement software are people using?
A few people noted that they were using either Cacti, Arbor or InMon. An individual from a major university noted that they were using something called Profusus (?). It was a flow monitoring solution that kept 100% of the data, without doing any aggregating. They use three flash drives in a RAID configuration to store the data, otherwise it'd take hours to track a single flow. Ken noted that the aggregating was why they'd gotten away from RRD.
Has anyone had looked into monitoring at high resolution?
Most of the current tools do 5 minute or 1 minute averages, and there is some interesting sub-second microburst activity when doing 1 second polling. The problem is that sampling that fast tends to overload the router, though Cisco is being pressured to support that use-case.
Someone from IU noted that they were doing 10 second polling, and that for some routers, it works well. For others, the counters might not update that fast. He noted that sometimes when router software gets updated, it will break the 10 second polling.
Since high speed polling is inaccurate, folks were asked if anyone was using passive taps, or similar to do monitoring. One person noted that they were doing port mirroring, and were passing the mirrored packets to a commercial packet analyzer. Another noted that he'd killed a 6509 using port mirroring.
A number of folks were using software to obtain NetFlow/sFlow measurements. An administrator at a major university commented that he was doing lots with flow data, because they were completely a Brocade shop. Ken noted that at PSU, they used Brocade at the border that feeds sFlow to their InMon instance, but that the security group gets mirrored ports.
Someone brought up the fact that California is starting to measure mobile wireless broadband out of the concern that the data provided by the carriers doesn't match the experience of the end users. There were three areas of concern that she brought up: education communities in remote areas, football stadiums, and 'dead zones' in the middle of urban areas. The hope is that if they can show the carriers how bad some of these areas are, they could push the carriers to fix them. She thought that Jim Warner might be able to talk about it at Joint Techs in Stanford. Ken noted that at PSU, they're peering with AT+T, and the measuring AT+T's performance from their side.
Multicast tools: some are using multicast beacon and some are using dbeacon. NYU mentioned IPv6 Beacons.