UKCMG Industry Forum November 2006

Transcription

1 UKCMG Industry Forum November 2006 Capacity and Performance Management of IP Networks Using IP Flow Measurement

2 Agenda Challenges of capacity and performance management of IP based networks What is IP flow? The benefits of deploying IP flow measurement Market direction with regard to IP flow tools IP flow measurement overhead Summary and conclusions Capacitas

3 Challenges Enterprise IP networks typically consist of a large number of infrastructure components IP networks are shared resources IP networks service a large and diverse number of workloads Historically there were a limited set of tools available with which to analyse the workload mix on an IP network Contrast this to server environments where workload accounting tools are prevalent WAN bandwidth capacity is expensive Capacitas

4 Performance Management Challenges Corporate Data Centre CRM Intranet Financials Why is this link congested? Internet Manchester Office Newcastle Office London HQ Capacitas

5 Cross-Charging Challenges Corporate Data Centre CRM Intranet Financials Proportion of internet network traffic that is ? Internet Manchester Office Newcastle Office London HQ Capacitas

6 Capacity Management Challenges Corporate Data Centre CRM Intranet Financials Internet Manchester Office What is the baseline network demand of CRM for London users? London HQ Newcastle Office Capacitas

7 Capacity Planning Challenges Corporate Data Centre CRM Intranet Financials Internet Manchester Office What is the breakdown of network demand by application type? Newcastle Office London HQ Capacitas

8 Challenges Traditional SNMP-based performance monitoring does not provide sufficient information with which to deliver bestpractice capacity management We must be able to characterise the network workload in order to deliver best-practice network capacity and performance management We need to know the type of network workload AND where it's coming/going to. Increasingly important as enterprises adopt multi-service networks Voice/data convergence is now a reality Capacitas

9 Limitations of Probe Based Solutions Historically, probe-based solutions have been deployed to measure workload mix on the network A number of limitations with this approach including: RMON-based solutions can capture conversations but not flows Scalability - a probe is required at each and every measurement point Cost Capacitas

10 What is IP Flow? An IP flow is defined by the following 7 unique keys over a predefined time window: Source IP address Destination IP address Source port Destination port Layer 3 protocol type Differentiated Services Code Point (DSCP) Input logical interface If two packets have the same values for all 7 keys, then both packets are part of the same IP flow DSCP is a 6-bit code used for IP class of service Capacitas

11 What is IP Flow? Corporate Data Centre CRM ; Source port 777 An IP flow enabled router Measurement enabled on a per interface basis Interface 1/0 Internet Manchester Office x London HQ x Newcastle Office x Capacitas

12 Source IP address Destination IP address Source port What is IP Flow? Destination port 777 Layer 3 protocol TCP DSCP Input interface 1/0 In this case the source and destination port for CRM is 777 This packet is part of a CRM flow between a CRM server and a client at the London site, in the traffic class Capacitas

13 Flow information (Source IP address, destination IP address, etc) 2. After the flow expires, the IP flow enabled router exports the summarised information about the flow to a collector engine Total bytes What is IP Flow? Total packets Collection engine Exporter 1. Router (exporter) gathers information about the flows on its inbound interfaces and stores temporarily in its cache 3. Management application for reporting, analysis, etc. Management application Capacitas

14 What is IP Flow? Measurement is carried out at the router We use capabilities that are already bundled in the router software, leveraging the existing investment No need for probes Investment required in a collection engine and management application Capacitas

15 IP Flow Technologies NetFlow Cisco proprietary Part of Cisco IOS Version 9 is the current version IP Flow Information Export (IPFIX) Open standard by the Internet Engineering Task Force (IETF) Based on Cisco NetFlow version 9 data-export format Extendable to define keys in addition to the 7 standard base keys Status on 9 th November 2006: Approved-announcement sent Capacitas

16 IP Flow Technologies sflow Managed by sflow.org, an international, multivendor, end-user forum Supported in the products of these manufacturers: AlaxalA Networks Alcatel Allied Telesis Comtec Systems Extreme Networks Force10 Networks Foundry Networks Hewlett-Packard Hitachi NEC Capacitas

17 Benefits of Deploying IP Flow Workload characterisation by organisational group Capacitas

18 Benefits of Deploying IP Flow Workload characterisation by layer 3 protocol type Capacitas

19 Benefits of Deploying IP Flow Workload characterisation by application: Capacitas

20 IP Flow Tools Market IP flow tools have traditionally been deployed within ISPs Increasingly enterprises have a requirement to deploy IP flow tools in order to understand end-to-end application performance Tools vendors are moving accordingly: The big four ; IBM, CA, BMC and HP all have an IP flow offering Many more specialist vendors have IP flow offerings There are offerings to meet all budgets and environment sizes For example to monitor flows from 8 routers and 80 interfaces, licence costs vary between 2k - 60k, depending on vendor Capacitas

21 IP Flow Tools Market Cisco is moving into the application space with its Service Orientated Network Architecture (SONA) SONA attempts to condense the network, services, and applications onto one intelligent fabric A key part of SONA is the Network Application Performance Analysis (NAPA) toolset NetFlow is part of this toolset Capacitas

22 IP Flow Tools Checklist Support for IPFIX if you have a mixed-vendor network environment Scalability is required in order to avoid multiple discrete collection engines Integration with SNMP-based measurements Reverse DNS lookup Configurable data retention Configurable data aggregation Evidence of the tool s scalability in a customer s site Scalability should be defined in terms of flow throughput across measured nodes Support for flow de-duplication Capacitas

23 Support for Flow De-duplication Corporate Data Centre CRM ; Source port 777 A single CRM flow will be measured 3 times in this example Manchester Office x London HQ x Newcastle Office x Capacitas

24 Manage Measurement Overhead Overhead of processing flow measurement on the router Testing of NetFlow by Cisco has demonstrated the following typical overheads: 10,000 active flows: 7% additional CPU utilization 45,000 active flows: 20% additional CPU utilization 65,000 active flows: 21% additional CPU utilization etsol/ns583/c654/cdccont_0900aecd80308a66.pdf Memory overhead is typically 64 bytes per flow So 65,000 active flows equates to 4 MB of DRAM Capacitas

25 Manage Measurement Overhead Limit the number of routers and interfaces that are enabled to measure IP flows Employ flow filtering at the router/collector engine Deploy collector engine(s) close to IP flow routers Capacitas

26 Manage Measurement Overhead Option to use packet sampling with NetFlow, IPFIX and sflow Cisco report that 1:100 sampling required only 3-percent additional CPU with 65,000 active flows Research indicates sampled NetFlow is accurate: Capacitas

27 IP Flow Considerations IP flow export packets sent over a congested network may be lost, depending on the transport used UDP User Datagram Protocol TCP Transmission Control Protocol Byte-streaming SCTP Stream Control Transmission Protocol Message-based, multi-streaming Exports over UDP may be lost in a congested network TCP and SCTP are congestion aware transports Support Matrix UDP TCP SCTP NetFlow Yes No Yes IPFIX Yes Yes Yes sflow Yes No No Capacitas

28 IP Flow Considerations Your network may be partially outsourced IP flow can be deployed at the hand-off points Your network may be fully outsourced IP flow deployment must be negotiated with your service provider Capacitas

29 Try it Out! Can my routers/switches measure flow information? Device Cisco 800, 1700, 2600 Cisco 1800, 2800, 3800 Cisco 4500 Cisco 6500 Cisco 7200, 7300, 7500 Cisco 7600 Cisco 10000, 12000, CRS-1 Cisco 2900, 3500, 3660, 3750 Supported Yes Yes Yes Yes Yes Yes Yes No Capacitas

30 Try it Out! Can my routers/switches measure flow information? Devices that support sflow are detailed here: Capacitas

31 Try it Out! Free/trial versions are available: Commercial: NetFlow Analyzer etflow/index.html Scrutinizer Open source: nprobe Extensive list of freeware and commercial tools: Capacitas

32 Deployment Tips Pilot to ascertain the flow throughput at your intended measurement points Only monitor flows where required. Many enterprises host applications centrally During pilot, validate measurements by comparing total network throughput given by flow tools to that given by SNMP-based measurements Capacitas

33 Summary and Conclusions Network capacity management need not be any more difficult than systems capacity management IP flow measurement is a key enabler to conduct end-to-end capacity management of an IT service IP flow measurement leverages existing investment in network hardware With the arrival of IPFIX, IP flow measurement is likely to become standards based and vendor independent Extensive choice of vendors for collector engine and management applications both in scale of deployment and cost of solution Capacitas