[j-nsp] Packet Size Distribution Statistics

[sthaug at nethelp.no]

> Does anyone know a way to get stats on the packet sizes being sent
> through the network.
> 
> We have MX nodes and cflowd with version 5, but doesn't seem to detail
> packet size.
> 
> Are there any accounting features that can be turned on to give us some
> information?

If you are exporting netflow information from your routers to a 
netflow collector, you have all you need to extract information about
packet sizes. For instance, the following command from the flow-tools
package:

% flow-stat -f1 -S3 < ft-v1005.2010-08-24.162001+0200 | more
#  --- ---- ---- Report Information --- --- ---
#
# Fields:    Total
# Symbols:   Disabled
# Sorting:   Descending Field 3
# Name:      Average packet size distribution
#
# Args:      flow-stat -f1 -S3
#
#
# Pkt Size  flows                 octets                packets
#
1464        177467                498440760             340465
40          191448                9816065               245384
52          63649                 4117526               79174
48          50190                 3156051               65737
1430        21613                 77647710              54299
1420        23541                 54095080              38095
576         5335                  5527304               9596
64          8856                  600034                9374
200         4049                  1799247               8996
58          7315                  480284                8278
51          5745                  413090                8098
60          6954                  459630                7659
1500        4950                  11404500              7603

As you can see we have to very clear peaks in number of packets, at
close to max (1464 bytes) and 40 bytes (presumably TCP ACK).

Steinar Haug, Nethelp consulting, sthaug at nethelp.no