[c-nsp] Detecting Traffic shaping

[Roland Dobbins]

On Dec 22, 2006, at 3:37 PM, nachocheeze at gmail.com wrote:

> And all of the above talk only has to do with your edge router to the
> remote site.  What is your local LAN infrastructure like?  What is
> your user base like?  Do you have a bunch of folks with high end,
> large bus speed (PCI-X / PCI-Express) Gigabit network cards connected
> via Cat6 or Cat5e to huge backplane LAN hardware like Cisco 7600s,
> with a 10 GigE switched backbone?
>
> Or do you have a bunch of folks with Pentium III's with old flaky
> 10/100 cards running Cat 3 wiring to a bunch of shared collision hubs
> at half duplex?

Proxies and firewalls are sometimes culprits in situations like this,  
as well.  Or simply bandwidth starvation of the last-mile hop due to  
excessive P2P downloads, etc.  It would be a really good idea to work  
on characterizing your traffic, perhaps with NetFlow and an open- 
source tool like nfdump/nfsen, as a good first step.

One thing to examine as part of the discovery process is whether or  
not it's just HTTP traffic on TCP/80 which seems to be affected, or  
other applications such as ftp, ssh/scp, video streaming over UDP, etc.

And, of course, one should investigate whether access to internal  
services and the services/applications running on them suboptimal, as  
well?

Lots and lots of potential variables, here.  Start with  
characterizing your traffic, that would certainly provide visibility  
into what's taking place on the network.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at cisco.com> // 408.527.6376 voice

		All battles are perpetual.

     		   -- Milton Friedman