Re: Call for censensus on path forward
Simon Leinen <[email protected]>
| Newsgroups | gmane.ietf.eos |
|---|---|
| Message-ID | <[email protected]> |
On Sat, 21 Sep 2002 20:18:34 +0900, Glenn Mansfield Keeni <[email protected]> said: > a. Traffic graphs for a Gigabit network polled at, say, 1 minute > intervals are USELESS. What we end up seeing is the traffic > averaged over a minute! One never sees that real traffic > characteristics from these graphs. [Isn't there anyone out there > monitoring a high speed network ? I would be interested to know > how you do it.] We poll every five minutes and make sure that those devices support 64-bit counters (if you think all Gigabit-capable router interfaces support them, you'd be surprised). I don't quite grasp the connection you make between network capacity and polling intervals. When I want to do analysis on the packet level, then yes, on faster links packets will be shorter. But then I wouldn't use SNMP anyway but more suitable mechanisms such as port copy/header traces or some kind of packet sampling. In general, high-speed links aggregate lots of microflows and I'm interested in similar timescales than I would for slower links. If anything, microscopic traffic patterns are less of an issue on high-speed links because queueing tends to be less visible in faster/more aggregated parts of the network. We do sometimes use a tool that polls a router's if[HC]{In,Out}Octets counters every few seconds and displays them as an animated table. But we notice that the interface counters (which are presumably in some kind of ASIC) aren't exported to the SNMP agent all that often, so intervals shorter than 5 or 10 seconds would give very weird results on most platforms anyway. -- Simon Leinen [email protected] SWITCH http://www.switch.ch/misc/leinen/ Computers hate being anthropomorphized.