Notes from Performance Working Group at 2012 Spring Member Meeting
April 23, 2012
http://events.internet2.edu/2012/spring-mm/agenda.cfm?go=session&id=10002344&event=1036
• Welcome -- Ken Miller, PSU (Working Group Co-Chair)
• Internet2 Update -- Jeff Boote
• Performance Portal Preview (design, privacy considerations, etc.) - Jeff Boote and Aaron Brown, Internet2
see slides at: http://www.internet2.edu/presentations/spring12/20120423-boote-perfportal.ppt
• Using mock data currently
• Call for participation to discuss operation and data privacy
• WAN Metrics Project at PSU (including financial angles of network measurement) – Ken Miller
see slides at: http://www.internet2.edu/presentations/spring12/20120423-miller-psu-wan-metrics.pdf
• Software Defined Networking / Open Flow - Group Inquiry
• How do we measure openflow and the controllers?
• A few people are running OpenFlow in test
• Question from NYU about measuring openflow on layer 2 and layer 3.
• Stanford wrote some software that will provide some measurements.
• Reminder of The Challenge - Ken Miller
• What does this community need?
• What do the next generation of NOC tools and/or Advanced User tools look like?
Community Updates / Open Forum
What kinds of network measurement software are people using?
A few people noted that they were using either Cacti, Arbor or InMon. An individual from a major university noted that they were using “Proquesys Flowtraq” http://www.flowtraq.com/corporate/ . This is a flow monitoring solution that keeps 100% of the data, without doing any aggregating. They use three flash drives in a RAID configuration to store the data, otherwise it'd take hours to track a single flow. Ken noted that the aggregating was why they'd gotten away from RRD.
Has anyone had looked into monitoring at high resolution?
Most of the current tools do 5 minute or 1 minute averages, and there is some interesting sub-second microburst activity when doing 1 second polling. The problem is that sampling that fast tends to overload the router, though Cisco is being pressured to support that use-case.
IU is doing 10 second polling, and that for some routers, it works well. For others, the counters might not update that fast. He noted that sometimes when router software gets updated, it will break the 10 second polling.
Since high speed polling is inaccurate, folks were asked if anyone was using passive taps, or similar to do monitoring. One person noted that they were doing port mirroring, and were passing the mirrored packets to a commercial packet analyzer. Another noted that he'd killed a 6509 using port mirroring.
A number of folks were using software to obtain NetFlow/sFlow measurements. An administrator at a major university commented that he was doing lots with flow data, because they were completely a Brocade shop. Ken noted that at PSU, they used Brocade at the border that feeds sFlow to their InMon instance, but that the security group gets mirrored ports.
California is starting to measure mobile wireless broadband out of the concern that the data provided by the carriers doesn't match the experience of the end users. There were three areas of concern that she brought up: education communities in remote areas, football stadiums, and 'dead zones' in the middle of urban areas. The hope is that if they can show the carriers how bad some of these areas are, they could push the carriers to fix them. Ken noted that at PSU, they're peering with AT+T, and measuring AT+T's performance from their side.
Multicast tools: some are using multicast beacon and some are using dbeacon. NYU mentioned IPv6 Beacons.