Subject: Re: about topN within one day / toptalkers and AS
From: Michael Hare (michael.hare@doit.wisc.edu)
Date: Wed Sep 26 2001 - 10:58:32 CDT
All- I work in the same group as Dave Plonka, and also work for WiscNet, which is Wisconsin's statewide educational network. I'm running a heavily modified version of flowscan that is collecting sampled flows from two junipers and one GSR; currently my AS stuff is being calculated only from one of our BGP tables; I'm working on fixing this as well. I've hacked FlowScan to take care of the sampling (Dave is working on a more formal version destined for release), and I've also added code that, every 5 minutes, updates a few mySQL tables with AS and per host traffic statistics; I summarize this information at the end of each day. So not only do we have AS information for every AS out there (good for making peering decisions), I can also supply a toptalkers list, per subnet, for each of WiscNet's 500+ institutions, getting around the dance of taking the top 25 of "top 25 5 minute samples" (I had written scripts to do this as well).. In summary: I get can a true daily toptalkers. I'm doing 1/192 packet sampling, so I'm only doing 600 flows per second during peak on a dual p3 1Ghz. Updating ~ 30000 mysql rows from within FlowScan barely affects my performance. -Michael At 04:28 PM 9/26/2001 +0200, Grzegorz Janoszka wrote: >On Wed, 26 Sep 2001, Eric Gauthier wrote: > > > Let me give you an example. Lets say that you move a constant 2.4Mbps > > worth of traffic to AS xxx. Lets also say that, on average, you move > > 1.5Mbps to AS yyy and 1.5 Mbps of traffic to AS zzz. Lets also say > > that there are 9 other AS's who you move more than 2 Mbps to. > > > > Lets say that, in a particular 5 minute interval, the traffic to AS yyy > > bursts up to 2.5 Mbps while AS zzz is at 1.0 Mbps and AS xxx stays at their > > constant 2.4Mbps. Then, AS yyy becomes the 10th loudest speaker, > > ends up at the bottom of the table, and AS xxx isn't listed. Now, > > lets say in the 2nd 5 minute interval, AS yyy drops down to moving only > > about 1.0 Mbps but AS zzz bursts up to 2.5 Mbps. Again, AS zzz becomes > > the 10th loudest speaker, ends up at the bottom of the table, and AS xxx > > isn't listed. If this alternated back and forth, then AS xxx would never > > show up in the table but AS yyy and AS zzz would show up in alternating > > tables. When you aggregate your information, then you'll have entries > > for AS yyy and AS zzz but nothing for AS xxx - even though the average > > throughput for AS xxx is 2.4 Mbps, for AS yyy is 1.75 Mbps, and for > > AS zzz is 1.75 Mbps. > > > > Doing the aggregation like this is a nice way to get an idea of what's > > going on, but it should be taken with a large grain of salt. > >I haven't checked it exactly (too much zzzzz ;-) ) but I agree. >There is one solution: the bigger N in TopN - the better precision. > >-- >Grzegorz Janoszka, Onet.pl S.A. > > >-- >Help mailto:majordomo@net.doit.wisc.edu and say "help" in message body >Unsubscribe mailto:majordomo@net.doit.wisc.edu and say >"unsubscribe flowscan" in message body >Archive http://net.doit.wisc.edu/~plonka/list/flowscan/archive/ /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ Michael Hare UW-Madison Network Engineering WiscNet Network Engineering My phone: 608-262-5236 24-Hour NOC: 608-263-4188 WiscNet: 608-265-6761 -- Help mailto:majordomo@net.doit.wisc.edu and say "help" in message body Unsubscribe mailto:majordomo@net.doit.wisc.edu and say "unsubscribe flowscan" in message body Archive http://net.doit.wisc.edu/~plonka/list/flowscan/archive/
This archive was generated by hypermail 2b25 : Wed Sep 26 2001 - 12:48:35 CDT