Application Aware Traffic Engineering and Monitoring

Transcription

1 Course Number Presentation_ID 2000, 1999, 2000, Cisco Cisco Systems, Systems, Inc. Inc. 1 Application Aware Traffic Engineering and Monitoring Session 2000, Cisco Systems, Inc. 2

2 Agenda Challenges, Metrics, and Measurement Strategies Measurement Technologies NetFlow SA Agent Case Studies NBAR ART MIB 3 Traffic Engineering in a Multiservice Network VoIP ERP Multimedia VPN Web/URL Low Latency Low Bandwidth Latency Tolerant Bursty Bandwidth Network Must Provide Each Application With Different Service Level Characteristics Simultaneously 4

3 Application Traffic Engineering Challenges Planning Verify application impact on the network and vice-versa Deployment of new applications and services Gain understanding of traffic flows Utilization and latency dependent on application mix Troubleshooting Bursts in traffic load caused by applications Service degradation Rogue applications that hijack the network Misconfigured applications 5 Application Performance Metrics Responsiveness Availability Throughput Utilization Jitter 6

4 Responsiveness Client Web Browser DNS Request DNS Response DNS Server Si TCP Connect TCP Ack HTTP Request HTTP Response Web Server The response time to fulfill a request for service Measurement based on the start of fulfillment When the server responds with requested data Not all services requested are the same effort 7 Availability X Traffic Destination As a percentage of time the service is actually provided Network service is not busy Network service is not down Network service does not introduce errors As a function of MTBF and MTTR 8

5 PSTN Throughput VPN LAN 48 Kbps 128 Kbps T1 10 Mbps Provisioned 26 Kbps Observed Transmission rate of observed data transport measured in: Bits/bytes per second Packets per second Differences between provisioned and observed due to: Oversubscription of circuit Router utilization Server congestion 9 Utilization Percent of total bandwidth consumed Per interface Per interface by traffic class Per interface by application or protocol 25% 15% 20% 10% 12% 18% 10

6 Delay Variation Jitter Source Destination PBX Network PBX A B C Source Transmits t A B D 1 D 2 = D 1 D 3 = D 2 C Destination Receives t The change in packet interval for sequential packets Source transmits with constant inter-packet interval During network transit, inter-packet interval is affected At destination, variation of inter-packet interval is jitter 11 Performance Measurement Strategies Synthetic Sampling Method Observed Collection Method Embedded Agents External Probes Device/Link Scope of Measurement End-to-End/Path End-to-End/Path User Perspective of Measurement Network 12

7 Sampling Method Definition Actual end-user network traffic where performance is measured by timing specific application traffic flows Advantages Synthetic Most accurate for live application traffic on a specified link Disadvantages Limited to measuring: Existing traffic types, which may not be present on the network at all times Existing traffic patterns, which may not reflect patterns for new or future applications Definition Network traffic generated strictly for the purpose of measuring a network performance characteristic Advantages Observed Measures performance: Between any two points in the network Controllable, on a continuous basis By traffic class based on IP Precedence marking Disadvantages Only an approximation for performance of live traffic 13 Collection Method Definition Mechanisms for collection of network statistics are integrated into the network communication device (e.g., router or switch), itself Advantages Embedded Follows network infrastructure Gathers metrics that can not be observed externally Disadvantages Performance monitoring has device-level performance implications Definition Mechanisms for collection of network statistics are provided by a stand-alone device specifically designed to collect network performance statistics Advantages External Validation of performance performed independent of the devices that transmit network traffic Disadvantages More hardware to administer Observed statistics limited to points of deployment 14

8 Scope of Measurement Device or Link Oriented Definition Performance measurement based on analysis of specific device or device interface, and typically based on utilization rates Advantages Detailed application performance monitoring of critical network links Disadvantages When network-wide performance problems exist, how does one select which device or link to evaluate? Definition End-to-End Performance measurement based on analysis of response time across two or more network devices, and typically based on latency Advantages Starting point performance troubleshooting Reflects end-user experience Disadvantages Prior knowledge of relevant end-to-end paths is needed 15 Perspective of Measurement Definition Measurement based on performance statistics measured at the end-user workstation Advantages User Accurate measurement of end-user experience Disadvantages Scale and distribution issues Intrusive on the desktop Definition Measurement based on performance statistics measured in network devices Advantages Network Easy to deploy, and non-intrusive to the desktop Identifies network performance issue Disadvantages Imperfect understanding of enduser experience 16

9 Application Measurement Technologies 2000, Cisco Systems, Inc. 17 Measurement Technologies NetFlow MEASURES: Device interface traffic rate by s/d IP address, port number or AS ART MIB Application Response Time SNMP MIB MEASURES: Response time of live application traffic to server device Sampling: Collection: Scope: Perspective: Observed Embedded Device/Link Network Sampling: Collection: Scope: Perspective: Observed External Probe End-to-End User/Network SA Agent Service Assurance Agent MEASURES: Latency and Jitter between source router and specified target NBAR Network-Based Application Recognition MEASURES: Device interface utilization by application type or QoS traffic class Sampling: Collection: Scope: Perspective: Synthetic Embedded End-to-End User/Network Sampling: Collection: Scope: Perspective: Observed Embedded Device/Link Network 18

10 Measurement Technologies NetFlow 2000, Cisco Systems, Inc. 19 NetFlow Defined Flows are defined by 7 keys: Source Address Destination Address Source Port Destination Port Layer 3 Protocol TOS byte (DSCP) Input Interface Flows are unidirectional Flows are enabled on a per input-interface basis Flows can be configured on-demand or continuous Flow Data Exported to Management Application 20

11 RMON Accessible Usage Device Interface QoS NetFlow Data Record per Flow Packet Count Byte Count Input Interface Output Interface Type of Service TCP Flags Protocol Source IP Address Destination IP Address Source Prefix Mask Destination Prefix Mask Source AS Number Destination AS Number Source TCP/UDP Port Destination TCP/UDP Port Routing and Peering Application Usage Number of Flows Flow Size Distribution Non-RMON Time Stamp Start Timestamp End Timestamp Call Duration Next Hop Address Lost Datagrams 21 NetFlow Related Applications Network Planning RMON Probe Accounting/Billing Flow Profiling Network Monitoring NetFlow/ Data Export Flow Collectors Management Application End-User Information 22

12 Measurement Technologies SA Agent 2000, Cisco Systems, Inc. 23 Service Assurance (SA) Agent Defined Head Office LAN Router Chicago VPN-Gwy-SFO Users wwwin-hr ISP Router New York Branch Office Embedded technology in Cisco IOS devices Synthetic traffic for various protocols Supports IP precedence for QoS Measures latency, jitter and availability RTP Irvine Mass 24

13 Service Assurance Agent Operation Types Operations IOS Release 11.2/11.3 IOS Release 12.0 IOS Release 12.0T/12.1 ICMP Echo (Ping) X X X IP Path Echo X X X LU0/LU2 (3270 Ping) X X X SSCP (SNA) X X X UDP Echo TCP Connect UDP Jitter IP Precedence DNS Name Resolution DHCP Get IP Address DLSw Peer Tunnel HTTP Note: IP precedence can be combined with other operation types to simulate QoS traffic marking 25 X X X X X X X X SA Agent Example of Latency Graph 26

14 Measurement Technologies NBAR 2000, Cisco Systems, Inc. 27 NBAR Network-Based Application Recognition Cisco IOS-based protocol discovery featuring: Measure interface utilization by protocol or traffic class Stateful Inspection for non-symmetric protocols See list of protocols Define QoS traffic classes HTTP traffic by URL or MIME type NBAR Process SNMP or Web Reporting Queue 1 Queue 2 Queue 3 Queue 4 Queue 5 Queue 6 28

15 NBAR Partial List of Protocols Identified Statefully-inspected protocols SQL*Net Sun RPC H.323 MSExchange UNIX r commands VDOLive RealAudio MS Netshow HTTP (via URL/MIME) FTP L4 L7 protocols which dynamically assign TCP/UDP ports Static-port protocols CuSeeMe EGP GRE ICMP IGMP IMAP OSPF BGP DHCP DNS Finger Gopher HTTP IPSec IRC L2TP LDAP NFS NNTP NTP NetBIOS Notes OSPF PCAnywhere POP3 RIP RSVP Secure HTTP SMTP SNMP SOCKS SSH Streamworks TFTP Telnet X Windows Etc. Support for Additional Protocols Is Software Definable 29 NBAR Example of Protocol Discovery 30

16 Measurement Technologies ART MIB 2000, Cisco Systems, Inc. 31 ART MIB Implementation Example Dedicated RMON probes for critical links and highspeed backbones ART monitoring option installed on key probes Application monitoring tools for measuring application performance and response time FE/Gigabit Probe ART TR Probe FDDI Probe FDDI Ethernet Probe ATM Probe ART WAN Probe ART Application Monitoring Tools WAN 32

17 ART MIB Functionality TCP protocols only (1.0) Based upon well-known destination port Default protocols: AOL COMPUSRV DLSW_RD DLSW_WR DNS_TCP DOOM FTP-CTRL FTP-DATA HTTP HTTPS NB_DGM_T NB_NS_T NB_SSN_T NEWS_TCP NNTP NOTESTCP ORACLSQL REALAUD SMTP SNA_TCP SOCKET SQLNET_N SUNRPC_T TELNET XWINDOW Client Latency C Response Time Application Level Response Time SEQ 101 ACK 101 SEQ 102 SEQ 103 SEQ 104 ACK 104 SEQ 105 ACK 105 Network Flight Time Identify Application Example: FTP Packet Level Measurement Server Latency 33 S Server address Number of clients For all (summary) clients: Min/avg/max response time Request/response pair count Response time distribution Client and server octets and overflows Retries Timeouts ART MIB Example of Reporting 34

18 Case Study 1: Troubleshooting Application Response Time Issues 2000, Cisco Systems, Inc. 35 Network Environment Large banking institution Web-based application being used for both internal and external customers Application had been running for several months without problems Organization Four service groups: Firewall group Local application group (proxy server) Network group Application group (application deployment) Internet The network Proxy Server Clients attached to 10 Mbps VLANS Web server access via the Internet Web Server Web access via a proxy server Firewalls running NAT 36

19 Problem Description Upon switching to secured access (HTTPS), users experienced excessive response time problems ( hourglass mode for minutes) All service groups were pointing fingers at each other 37 Technical Analysis Internet Proxy Server ART ART ART Web Server Analyze network traffic TrafficDirector and external probes with ART monitoring were used to profile the network No errors were found on the network Traffic volumes were within acceptable range Client conversations could not be mapped due to NAT Probe 1 Probe 2 Probe 3 Analyze application flow ART Monitor was used to determine response time at each step Average response time Probe 1: 130 ms Average response time Probe 2: 135 ms Average response time Probe 3: 138 ms Response time seemed reasonable, yet the client was still experiencing problems 38

20 The Resolution Internet ART Proxy Server ART ART Web Server Problem Isolation Probe 1 Initial analysis showed no problems Probe 1 was moved between the client and proxy server Significant delays in response time between the client and proxy server TrafficDirector was used to capture and analyze traffic data New proxy server was configured to retrieve the entire page from the web server before sending it to the client Probe 2 Probe 3 Resolution Reconfigured proxy server Response time for the user now acceptable Summary ART Monitor provided insight into the user experience TrafficDirector provided the tools to analyze the details of the problem The groups were able to share information and resolve the problem 39 Case Study 2: Analyzing Application-Network Interaction and QoS Activation 2000, Cisco Systems, Inc. 40

21 Network Environment Workstation configuration tracking /web browsing ERP Home Users 380+ Retail Outlets Dial-in 256K T-1 Frame Relay 128K HQ 56K 56K Bit Bucket 41 Problem Description Existing: PC configuration tracking Maintain consistent software configurations on 3,000+ PCs ERP Manage inventory worth over $400M at over 380 retail locations Manage daily pricing strategies at over 350 retail locations and web access Future: Voice over IP Use data infrastructure to reduce PSTN and cell phone charges Problems: PC configuration tracking congests T-1 Frame Relay from HQ to SP ERP, and web traffic are deprived reasonable bandwidth VoIP deployment to retail outlets is not possible Home users dial-in on 800 number, then use expensive cell phones 42

22 Technical Analysis NBAR is used for: Baseline application utilization QoS traffic class definition Monitoring QoS traffic class utilization 43 Solution: QoS Applied to Traffic Classes Traffic Class PC Configuration ERP and Web VOIP Minimum Guarantee Maximum Guarantee Queue Priority 10% of Link 33% of Link Normal 40% of Link None Normal 10% of Link 20% of Link Normal 15Kbps 15Kbps High 256K T-1 Frame Relay 128K 56K HQ 56K Bit Bucket X 44

23 Application Traffic Engineering Summary Effective traffic engineering requires: Determining which application performance metrics are relevant to the network environment Understanding which measurement strategies are most appropriate for obtaining performance metrics Knowledge of performance measurement technologies that will facilitate each measurement strategy 45 Other Networkers Topics of Interest SLAM presentation SAA presentation Demo at booth CiscoWorks2000 Product Overview 46

24 Application Aware Traffic Engineering and Monitoring Session 2000, Cisco Systems, Inc. 47 Please Complete Your Evaluation Form Session 2000, Cisco Systems, Inc. 48

25 2000, Cisco Systems, Inc. 49