%include "./default.mgp"
%tab bullet icon arc "blue" 40
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%nodefault
%bgrad 0 0 256 0 0 "cyan" "magenta"
%tfont "gn______.ttf"
%center, fore "black"
%size 20

cflowd
%size 8

overview

%tfont "cour.ttf", size 5

Daniel McRobb
dwm@caida.org

http://www.caida.org/Tools/cflowd/

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%bgrad 0 0 32 0 0 "cyan" "white"
%fore "black"
Outline
&bullet My Background
&bullet Network Management
&bullet Traffic Accounting at the Network (IP) Layer
&bullet A Small Survey of Past and Present Solutions
&bullet The NetFlow Solution
&bullet cflowd

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
My Background
&bullet 6 years at ANS
&bullet most of ANS tenure spent as network management system (NMS) developer
&bullet have experience designing and inmplementing real-time monitoring systems using ICMP, SNMP, UDP and TCP (up to and including application-level monitoring)
&bullet traffic accounting using packet sampling methods (NSFNET T3 network)
&bullet 1.5 years at CAIDA, continuing work on traffic accounting (cflowd) and active measurement (skitter)

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
Network Management
&bullet managing devices
&bullet managing resources
&bullet managing system behavior
&bullet managing growth
&bullet accounting

%%%%%%%%%%%%%%%%%%%x%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
Managing Devices
&bullet status usually monitored using ICMP and SNMP
&bullet often involves enterprise MIBs (vendor and device specific), traps and inform messages
&bullet vendor-specific solutions (standalone network management systems)
&bullet large solutions (Spectrum, OpenView, Tivoli, Unicenter, et. al.)

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
Device Management Problems
&bullet microscopic view of large number of devices: not a system solution
&bullet centralized solutions have scaling problems (too many devices to poll, large quantities of state information)
&bullet solutions intended to be real-time are often not what a network manager considers real-time
&bullet distributed solutions expensive to implement and maintain
&bullet multiple standalone solutions are a burden on network operation centers (learning curve, maintenance, closed architectures, etc.)

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
Managing Resources
&bullet bandwidth (usually monitored using SNMP MIB-II)
&bullet forwarding resources (memory, CPU) often monitored using enterprise MIBs
&bullet human resources

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
Resource Management Problems
&bullet same scaling hurdles as device management (many resources)
&bullet SNMP-based solutions (MIB-II, for example) usually sufficient to identify hotspots, but frequently not sufficient to identify cause or provide solutions outside of brute force (fatter pipes, bigger routers)
&bullet considerable human resources often necessary for interpretation of available information (disparate, microscopic data)

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
Example
What is causing link saturation?
%center
%image "hotspot1.gif"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
Managing System Behavior
&bullet routing stability: no 'usual' monitoring method, but several available (mrtd, expect scripts, etc.)
&bullet active measurements: does the system behave as intended?
&bullet failure scenario analysis
&bullet postmortem activities (what went wrong, how can I prevent it in the future?)

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
Managing Growth
&bullet trend analysis (typically based on MIB-II, several tools available)
&bullet capacity planning (also typically based on MIB-II, but often not sufficient)

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
IP Traffic Accounting Applications
&bullet system optimization and capacity planning
&bullet peering analysis (am I peering with the entities with which I exchange large amounts of traffic?)
&bullet input to modelling tools for failure analysis and bandwidth allocation
&bullet QOS-related activities (am I meeting my QOS objectives?)
&bullet various security-related activities
&bullet billing

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
Capacity Planning
&bullet how do I make the best use of my current resources (in particular, bandwidth)?
&bullet what are the most cost-effective additional resources?
&bullet if part of my network fails (backhoe fade), do I have capacity to handle the failure?  Where do I need the capacity, and do I know ahead of time?

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
IP Traffic Accounting
Problems
&bullet as network speed increases, many solutions are left behind
&bullet solutions depend on scale of task
&bullet different tools for different jobs and media

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
A Small Survey of Past and Present Solutions
&bullet packet sampling
&bullet packet sniffing
&bullet RMON
&bullet ocNmon and coral
&bullet RMON2
&bullet flow-based accounting

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
Packet Sampling
&bullet statistical packet header sampling, usually 1:N packets
&bullet used on NSFNET, other networks
&bullet rarely (never?) used today, though no apparent reason other than lack of implementations

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
Packet Sniffing
&bullet many solutions, mature technology
&bullet traditional solutions (tcpdump, et. al.) have problems at line rate of today's networks and today's technologies (shared media not common in backbone networks)
&bullet scaling problems (must manage mounds of data in backbone environment)

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
RMON
&bullet layer 2 summary statistics (station-to-station on LAN, for example)
&bullet data retrieved via SNMP (RMON MIBs)
&bullet mostly a campus and enterprise solution, not very useful in backbone environment

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
ocNmon and coral
packet header sniffing technology for ATM technology

Problems:
&bullet no oc48mon at this point in time
&bullet high-speed hardware (OC-48 and above) difficult to acquire
&bullet scaling issues make it difficult to collect all header data round-the-clock

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
RMON2
RMON plus layer 3 summary statistics

&bullet supported by some vendors in their hardware (external hardware not needed)
&bullet mostly inappropriate in backbone: most of the MIB contents are too granular
&bullet suffers same scaling issues as packet sniffing
&bullet a reasonable campus and enterprise solution in some environments

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
flow-based accounting
&bullet similar to packet header sniffing
&bullet turns packet headers into 'flows', which are summaries of traffic for a given unique tuple
&bullet flows are usually based (at least) on a 5 tuple: protocol, source IP address, source port (if UDP or TCP), destination IP address, destination port (if UDP or TCP)
&bullet flow created when new unique tuple is seen in traffic, terminated via timeout or flow-termination indicator in flow (TCP FIN, for example)

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
Example flow
%center
%image "flowExample.gif"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
IETF Flow-related Working Groups
&bullet RTFM
&bullet LFAP

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
The Cisco NetFlow Solution
&bullet based on IP flows (5-tuple of protocol, source IP, source port, destination IP, destination port)
&bullet router maintains flow state information (cache of current flows)
&bullet flow data can be exported via UDP
&bullet exported data may contain additional information per flow (source and destination netmask, source and destination interface, source and destination AS)

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
NetFlow Advantages
&bullet no additional network hardware needed
&bullet less data than packet sniffing (easier to manage data requirements)
&bullet versions 5 and above include useful data (AS and netmask information)

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
NetFlow Disadvantages
&bullet in the forwarding path, sometimes a performance constraint
&bullet still lots of data
&bullet vendor-specific solution (Cisco)

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
cflowd
&bullet receives NetFlow data via UDP (Cisco flow-export)
&bullet builds summary tables
&bullet client/server architecture for centralized collection of summary tables
&bullet centralized data focused on capacity planning

