Monitoring your WAN When, What and How

Transcription

1 Monitoring your WAN When, What and How Even though WAN performance monitoring tools have been available for close to a decade, less than a quarter of US WAN links are monitored by enterprises either by using their own equipment or their service providers. The ratio is even lower outside of the US. Are the total benefits of monitoring links enough to outweigh the costs of deploying and monitoring the links? What are the key benefits to monitoring your WAN circuits? What should you monitor with your WAN links? This whitepaper will help you calculate the value of link monitoring, help you calculate the total cost of downtime, understand the causes of slow service or application performance and effectively manage your bandwidth. When does it make sense to monitor WAN links? So why are some WAN links monitored and other links left unmonitored? In some cases, the costs of monitoring the links do not provide sufficient benefits to justify monitoring. Many WAN technologies such as Frame Relay, PPP and ATM are mature technologies that network managers let run unchecked. For these unmonitored links, performance and availability are more or less relegated to the service provider with very little customer visibility of link performance. Many network managers feel that the problems and inefficiencies occurring with most unmonitored WAN links are usually resolved in a sufficient amount of time or are allowed to continue unchecked because deploying costly monitoring solutions do not justify the incremental gains. A second reason is that many network administrators appear to still be at a loss as to where the key benefits of monitoring their WAN circuits lie. Network managers understand that there are plenty of tools in the market that give them data about their WAN performance, but they are still uncertain as to how the data can help them with their jobs. In either case, it s a simple cost-benefit equation. In the former case, the time and expense required to deploy monitoring does not provide enough additional benefit. In the latter case, the benefits of monitoring are not clear enough to justify the costs of deploying a monitoring solution. Mission-critical links Depending on the types of applications and users utilizing a given WAN link, the criticality of the need and the degree of proactive monitoring needed varies. If a WAN link is used to provide general corporate users with access to the Internet for business web surfing, the meticulous monitoring of link performance is probably not worth the expense. Traffic from an order fulfillment user at a branch office that needs access to customer records in order to complete a point-of-sale transaction is missioncritical and warrants constant monitoring to ensure it is performing flawlessly. In essence, WAN links deemed mission critical have a significant impact to the business and should be monitored.

2 Mission-critical WAN links usually fall into the following categories: Links that are absolutely necessary to keep customers satisfied. These links are typically those that carry real-time customer transaction type data. Examples include point-of-sale customer records access, credit card transactions, VoIP calls in customer call centers and other critical customer serving applications. Links supporting real-time applications that are essential for personnel. These links typically support end-user, missioncritical internal operations. Examples include e-commerce applications, web shareware applications, real-time inventory data access, video conferencing, and other real-time operational applications. Links supporting critical business tools. These are links supporting key back-office applications, especially in data centers. Examples include data exchange tools, remote mirror site back-up exchanges, remote server software upgrades and other back-office applications. Calculating the value of link monitoring The value of monitoring a WAN link is dependent on the criticality of the traffic being carried, the current efficiency of the network and the organizational structure of the company. One way to quantify value is to apply a simple mathematical formula to estimate value components employed through link monitoring. With this method, you simply calculate and then add up all the value components derived for the chosen link to be monitored. This value is then compared against the costs to deploy the selected monitoring solution to determine if the cost of monitoring is worth the benefits derived. Value component (per Year) MTTR value Labor time savings value Efficiency improvements Tools savings value Applying the formulas in Figure 1 to generate a numerical value for the benefits is typically done in a fairly subjective way. To illustrate this, let s use an example. Assume a given link is currently being monitored with a WAN probe. Based on past experience, the network manager has observed that the real-time monitoring capability on this link yields a two-hour decrease in mean-time-to-repair (MTTR) every year when compared with a similar unmonitored link. Assuming the mission-critical link has a value of $100/min.*, the value of monitoring for improving MTTR is $12,000 per year ($100/min. x 120 min. MTTR improvement/yr.) for this value component alone. The value for monitoring this link is even greater when other value components such as saved troubleshooting labor time and other network efficiency improvements are included as a result of monitoring the link. Obviously the magnitude of MTTR improvement and per minute value of a downed link will vary substantially from link to link and company to company. But, the fundamental value element and calculation formula remains the same. Calculating total downtime costs Evaluating whether to deploy link monitoring on a link-by-link basis makes sense if a network engineer is only looking to deploy simple stop-gap solutions on selected links. Determining the total value of a distributed Mathematical formula for estimating value Link downtime (min.) x # occurrence /yr. x $ value / min. Time saved (hrs.) x $ value / hr. x occurrence/yr. x # of people ROI increase from leveraging currently installed tools $ / yr. spent buying and maintaining eliminated tool Figure 1: Mathematical formulas for quantifying the value of monitoring WAN links * Examples using US dollars. WAN monitoring system may require a different approach, as adding up all the value components of all links to be monitored becomes unwieldy. In evaluating distributed WAN monitoring systems, you may want to start with the top-level costs associated with downtime. Fluke Networks has estimated that for a typical enterprise with $100M (USD) in annual revenue, the costs of downtime can be quite significant. (See Figure 2) Notice for each source of downtime, WAN links may be a major cost. Sources of downtime will obviously vary substantially from company to company, so an individual analysis of the cost contribution for your specific enterprise should be conducted before determining whether a distributed WAN solution is right for your organization. Based on analysis of the typical enterprise, however, WAN networks may be a significant source of downtime costs. What should you monitor within your WAN links? Let s now assume that at least a few WAN links have been identified as mission-critical and worthy of monitoring. The next logical question is, what are the things that are most important to monitor? With a sea of vendors all eager to sell network visibility to IT organizations, network managers rarely complain about a shortage of tools that can provide them with network performance data. End users using 2

3 these vendor tools receive a lot of data from their devices telling them about what s going on with their network. But, most users admit they are unable to make good use of the sea of data streaming to them when trouble occurs in the network or users complain about poor application performance. Network engineers are quick to point out that most network analysis tools lack the ability to clearly, easily and rapidly generate the exact network information needed to help isolate and resolve the wide variety of challenges they face. Different vendors have different solutions that are usually good at solving different point problems. But, in most instances, network engineers don t have the time nor budget to procure, learn and maintain solutions from all the different vendors needed to provide 100% monitoring of network activities. So what are the most important WAN activities enterprise network professionals are interested in monitoring? Fluke Networks recently conducted a user survey to determine what WAN link concerns and problems are of most interest to network engineers and administrators. This international survey showed that a vast majority of end users not only had very similar basic WAN link concerns, but the priority of the concerns were fairly uniform across all geographies surveyed. Not surprisingly, network engineers seek fundamental circuit visibility to proactively manage the bandwidth performance of their WAN links, as well as troubleshoot link problems that cause slow application response and service interruptions. Hence, monitoring relevant WAN metrics that best facilitate bandwidth management and identify service interruption sources are the things to watch when managing WAN links. Figure 2: Estimated cost of downtime for a typical enterprise with $100M in revenue (Shown in USD) (Derived from The Cost of Enterprise Downtime 2004: Cost Analyzer Infonetics Research) At first glance, concerns such as bandwidth management and basic visibility may mean different things to different people. To clarify and better understand the meaning of these concerns, Fluke Networks conducted interviews with selected survey respondents. Curiously, the interview results yielded a fairly consistent and common understanding of the top six concerns listed in Figure 3. In the subsequent sections, we share our findings on these top six concerns. Bandwidth management Bandwidth management ensures bandwidth is made available to users, servers, applications and other network devices in whatever form the enterprise network manager specifies. For a minority of users, bandwidth management means the relief of traffic congestion through mechanisms such as traffic shaping/policing/enforcement or compression. For a few others, bandwidth management means prioritizing traffic types like VoIP to ensure voice calls traversing the data network meet specific quality metrics. The vast majority of respondents, however, said bandwidth management simply means the ability to monitor user and circuit bandwidth consumption so the network manager has adequate, real-time information in order to take action that ensures proper throughput and error-free operation of the WAN link. For example, the network manager needs the ability to identify the cause of bandwidth bottleneck problems so that corrective action may be taken. Most of the time, these actions do not include things such as setting or changing class of service policies, buying more bandwidth or implementing compression technology. Corrective action typically includes simple network tweaks such as shutting down a port number to an unauthorized application like KAZAA or changing the time of a regularly scheduled download of software updates to remote servers and workstations. The other main need for bandwidth management is the ability to 3

4 continuously see what s going on with the network to deliver maximum efficiency of limited bandwidth in an environment of constant change from new application deployments, new service deployments and moves, adds and changes. Network managers indicated the need to monitor vital link statistics as key functions of a monitoring solution. Metrics such as link utilization, throughput rate and errors for each individual virtual circuit over various time horizons is extremely useful in verifying performance. (See Figure 4) Monitoring link utilization is a quick way to determine if the WAN is a bottleneck. If utilization is too high, then a closer examination of WAN activity is needed to determine the root cause. If utilization is within the design boundary, then there is evidence that the WAN is performing properly. Understanding the applications that utilize the WAN link is also very important for bandwidth management. This enables visibility of true bandwidth needs, bottleneck sources and detection of unauthorized applications. This visibility is essential when making traffic engineering decisions. (See Figure 5) Slow service and application performance Slow service or application performance can be caused by a variety of sources including the application itself, servers hosting the user, servers hosting the application and network elements such as switches and routers. Network managers need basic visibility across all major sources of performance inhibitors so that efficient triage of the problem area can be performed. Key metrics to determine the source of bottlenecks within the network or server include: Connection time Amount of time it takes to establish a TCP session between the client and server before data transfer can begin Figure 3: WAN link concerns based on survey results of network managers Figure 4: Utilization monitoring is essential for bandwidth management 4

5 Server delay Amount of time it takes for the server to begin responding to a request Data transfer delay Amount of time from when the server starts responding until it finishes sending data for a request Retransmission delay Represents the additional delay in the network round trip time due to retransmissions Network round trip time Amount of time it takes for a packet to traverse the network Visibility of these metrics yields a quick understanding of the slowdown source and is essential to effective and efficient implementation of corrective solutions. With no means for monitoring performance, network managers are likely to conclude that insufficient bandwidth is the source of the problem. The enterprise then attempts to remedy this either by buying a link with more bandwidth, or a PVC with a higher CIR. In many cases, this is a waste of money, as the source of the slowdown is elsewhere in the network. (See Figure 6) Figure 5: Monitor top applications to better manage bandwidth Figure 6: Monitor response times to triage slowdown sources 5

6 Basic visibility Basic link visibility allows you to quickly look at a given circuit to verify its performance. Network managers need this at-aglance look at the WAN circuit to eliminate the WAN as a source of the problem or pinpoint an area for further examination. It is also a quick look at the top metrics that characterize the WAN link to get an instant, real-time understanding of what the link is doing. (See Figures 7 and 8) Key metrics for basic WAN circuit monitoring include: Circuit connection Verifying the type of circuit (e.g. FR, PPP, ATM, etc.), the number of virtual circuits and their endpoint routers Utilization Quick glance to determine if a bandwidth bottleneck is present. This should include a view of the total circuit utilization, as well as top bandwidth consuming hosts, applications and virtual circuits Devices A display of all devices that are using the link including routers, servers, hosts and probes Problems A problem log display showing alarms and alerts generated by traffic monitoring probes Figure 7: Quickly view all key WAN performance areas Figure 8: Better manage the link by knowing what devices are on it 6

7 Uptime / service interruptions Problem alerts are an essential part of any monitoring solution. Proactive monitoring sends you alerts based on standard failure events, as well as user configurable threshold breaches. Corrective actions won t be made unless the network manager is aware of the problem. (See Figure 9) Figure 9: Problem logs proactively alert administrators to WAN problems Service provider provisioning Despite the best efforts of installers, technicians and engineers, errors happen during service provider provisioning. Hence, it is prudent to verify the link throughput you expect is actually being delivered. SLAs exist to assure you of the basic quality of service that will be available through your WAN. But monitoring is necessary to verify SLA compliance. Your throughput can be affected when traffic is dropped because of momentary congestion in the WAN. Knowing and verifying the throughput characteristics of your PVCs over time is important for the recognition of problems that are the result of temporary loads, systemic problem or simple miss-configurations. (See Figure 10) Figure 10: Verifying committed capacity from your service provider 7

8 Physical layer problems Just as it is prudent to verify committed capacity from your service provider, it is also important to monitor physical layer problems. The ability to cross-check physical layer performance eliminates finger-pointing between the enterprise and service provider and helps to quickly isolate or rule out physical layer issues associated with the WAN. When physical layer problems occur on a mission-critical link, MTTR is paramount as the impact to users is usually severe. (See Figure 11) Conclusion Monitoring mission-critical WAN links has demonstrated proven cost-benefit value for just about any enterprise, although the exact quantitative cost-benefit value must be estimated on a company-by-company basis. In order to achieve maximum WAN link efficiency and uptime of mission-critical links, real-time, active monitoring of WAN circuits must be performed. Network managers must first monitor key performance metrics on their WAN links so that they may thoroughly understand how their links are being used before taking corrective action. A lack of monitoring capability will result in WAN networks that are not optimally designed, implemented and maintained. Figure 11: Monitor the physical layer to reduce MTTR and finger-pointing NETWORKSUPERVISION Fluke Networks P.O. Box 777, Everett, WA USA Fluke Networks operates in more than 50 countries worldwide. To find your local office contact details, go to Fluke Corporation. All rights reserved. Printed in U.S.A. 4/ A-ENG-N Rev A