Subject: Re: about topN within one day
From: Eric Gauthier (eric@roxanne.org)
Date: Wed Sep 26 2001 - 08:58:47 CDT
Hello, > I have wrote a simple perl script that analyses all reports for the > current day and makes a topN as traffic (only text output, no html page). > Here is sample output for the script: > AS, to which we have generated the most traffic during last day > TPNET ( 5617): 37204 kbps 68300 kbps > IPartners ( 8246): 1247 kbps 3993 kbps > Dialog (15857): 1051 kbps 2150 kbps I've played around with writing scripts to do something very similiar to this (ie - find out who, on the period of a day, were the top talkers in a particular subnet). The approach that I've used (and that appears above) is to, the following day, go through all of the topN pages created during each 5 minute interval (288 of them) and aggregate information. Unfortunately, this only gives you a minimal statistic for certain speakers but isn't necessarily accurate because you are sampling a sampling. Let me give you an example. Lets say that you move a constant 2.4Mbps worth of traffic to AS xxx. Lets also say that, on average, you move 1.5Mbps to AS yyy and 1.5 Mbps of traffic to AS zzz. Lets also say that there are 9 other AS's who you move more than 2 Mbps to. Lets say that, in a particular 5 minute interval, the traffic to AS yyy bursts up to 2.5 Mbps while AS zzz is at 1.0 Mbps and AS xxx stays at their constant 2.4Mbps. Then, AS yyy becomes the 10th loudest speaker, ends up at the bottom of the table, and AS xxx isn't listed. Now, lets say in the 2nd 5 minute interval, AS yyy drops down to moving only about 1.0 Mbps but AS zzz bursts up to 2.5 Mbps. Again, AS zzz becomes the 10th loudest speaker, ends up at the bottom of the table, and AS xxx isn't listed. If this alternated back and forth, then AS xxx would never show up in the table but AS yyy and AS zzz would show up in alternating tables. When you aggregate your information, then you'll have entries for AS yyy and AS zzz but nothing for AS xxx - even though the average throughput for AS xxx is 2.4 Mbps, for AS yyy is 1.75 Mbps, and for AS zzz is 1.75 Mbps. Doing the aggregation like this is a nice way to get an idea of what's going on, but it should be taken with a large grain of salt. Eric :) PS: I haven't had my mornng coffee yet, so please excuse me if I rambled... -- Help mailto:majordomo@net.doit.wisc.edu and say "help" in message body Unsubscribe mailto:majordomo@net.doit.wisc.edu and say "unsubscribe flowscan" in message body Archive http://net.doit.wisc.edu/~plonka/list/flowscan/archive/
This archive was generated by hypermail 2b25 : Wed Sep 26 2001 - 09:04:09 CDT