RE: Netflow question

From: Tom Thomas (tthomas@torrentnet.com)
Date: Thu Mar 29 2001 - 13:24:11 EST

Greg,

I would love to talk with you about the thought behind using NetFlow for
network planning off line if you are willing.

On the billing side however I would suggest folks look here:

http://www.narus.com/

This is a solution that works well with juniper products in my experience.

Tom

-----Original Message-----
From: Greg Ketell [mailto:gketell@juniper.net]
Sent: Thursday, March 29, 2001 11:16 AM
To: Matt Ranney; juniper-nsp@puck.nether.net
Subject: Re: Netflow question

Hi Matt, How's life?

Responses below primarily for jnpr-nsp folks since you and I have talked
about this a bit already.

At 12:49 PM 3/28/2001 -0800, Matt Ranney wrote:
>"shiva" <shiva@iasiaworks.com> writes:
>
> > OK, here's the situation, as described by our developer building a
billing
> > app:
> > We want to do variable billing. Its hard to do that on the Juniper
> > platform.
> >
> > First of all, Juniper's NetFlow implementation can only handle 7000
> > packets per second. Our average packet size in the US is around
> > 130bytes, which translates to a sampling rate of around 7Mb/s. This
>[...]
>
>Since I wrote that originally missive, allow me to summarize:
>
>NetFlow on the Juniper platform does indeed work for statistical
>sampling of no more than 7000pps.

That is 7000 sampled packets per second. So if you do 1/1 sampling it is
true 7000pps. But if you SAMPLE using 1/N where N>1 then it is N*7000.

> It is not suited for billing.

It wasn't ever designed for per-packet billing. The original intention was
for network planning purposes. If you sample syn/fin you know where every
flow is going so can design your network optimally.

Although if you did syn/fin sampling to get relative percentages for
traffic destinations and then used the per-interface in/out statistics you
could come up with reasonable billing. Then it becomes selling to convince
the customers that it *is* reasonable billing. Yes, this is hard.

>If you want more accurate numbers, see if DCU can do what you want.
>DCU is handled by the IP2, and doesn't degrade performance at all.

To be clear, neither does sampling, even if you sample "too much"
traffic. The throttles in place protect the main function of the router,
which is routing so you continue to get full throughput.

So, unlike our friendly spin-meister implied, Sampling is not deadly to the
IP2. (;->)

GK

From gillsr99@yahoo.­óÅ; T
Received: from someone claiming to be
        web1102.mail.yahoo.com (web1102.mail.yahoo.com [128.11.23.­óÅ;)
        for <juniper-nsp@puck.nether.net>; Thu, 29 Mar 2001 22:02:11­óÅ;00
Received-Date: Thu, 29 Mar 2001 22:02:11 -0500
Received: (qmail 13068 invoked by uid ­óÅ;1)
Message-ID: <20010330030207.13067.qmail@web1102.mail.yahoo.com>
Received: from [63.97.217.210­óÅ; w
Date: Thu, 29 Mar 2001 19:02:07 -0800 (PST)
From: Stephen Gill <gills­óÅ;ya
Subject: Re: Netflow question
To: gketell@juniper.net, doleary@juniper.net, juniper-nsp@puck.nether.net
MIME-Vers­óÅ; 1
ContEnt-Type: text/plain; charset=us-ascii

Thanks to Dave O'leary, Greg Ketell and others for
providing the true impac­óÅ; i
JunOS. As a general summary from the previous
threads, here's the overall consensus:

* Use of the­óÅ; A

* Per "PR 11036" JunOS 4.1R3 fixes a bug in that if
the number of packets sampled was too large, the
sam­óÅ;g
and Memory. Keep in mind that Juniper has announced
EOL for JunOS 4.1 by May o­óÅ;01
FA-SW-0102-002).

* There is a 7000 sampled pps built-in limitation for
netflow, but the selection of sampl­óÅ;ac
very granular.

* Though netflow is not designed for billing, there
are ways to get around the pps limitation:­óÅ;ss
coMbine sin/fin sampling with per interface stats, use
Destination Class Usage, creativity, etc...

* Due to throttle­óÅ;am
functions of the IP2 (logging, load balancing,
filtering, forwarding, etc...). Sampling l­óÅ;at
arE primarily based on a limited pipe between the SCB
and RE, and the rate at wich the RE can write to disk.

The GSR­óÅ;n
list ;).

Hopefully this summarizes most of the information
posted

__________________________________________________
Do You Yahoo!?
Get e
h­óÅ;//

This archive was generated by hypermail 2b29 : Mon Aug 05 2002 - 10:42:41 EDT