The Value of Flow Data for Peering Decisions Hurricane Electric IPv6 Native Backbone Massive Peering! Martin J. Levy Director, IPv6 Strategy Hurricane Electric 22 nd August 2012
Introduction Goal of this session Quick introduction to flow data collection Show the value of flow data to peering operators Show some examples of flow data Caveats All data graphs are obfuscated; but REAL What I m not covering Picking a good software flow platform Configuring a working flow platform 22 August 2012 The Value of Flow Data for Peering Decisions - Hurricane Electric - Martin Levy Page 2
Flow measurements what is it? A method and protocol for exporting flows From a router, switch or network device To a collector A flow is (simplistically) traffic information from source to destination vs. just a count of bits Flow protocols sflow (see http://sflow.org/) NetFlow (Cisco v1, v5, v6, v7, v8, v9, v10 ** ) IPFLOW ** (RFC5101 RFC5102 RFC6313 etc) 22 August 2012 The Value of Flow Data for Peering Decisions - Hurricane Electric - Martin Levy Page 3
Traffic stats vs. Flow stats - an example It s a sample vs. every bit counted It s contains information (not just bits/second) Bandwidth graph IPv6 graph IPv4 graph 22 August 2012 The Value of Flow Data for Peering Decisions - Hurricane Electric - Martin Levy Page 4
Flow data methodology On router: Collect information for every packet or flow -or- Collect information for every N packets or flows Send collected information to a collector On collector: Save away data for later processing and display Provide a UI for display of data Save away as much as possible (within limits) 22 August 2012 The Value of Flow Data for Peering Decisions - Hurricane Electric - Martin Levy Page 5
Flow device and collector methodology Every router sends flow data to the collector Flow collector stores data, merges data and presents data 22 August 2012 The Value of Flow Data for Peering Decisions - Hurricane Electric - Martin Levy Page 6
The flow information packet (Netflow v5) Source IP address The magic BGP routing information for a peering manager or network engineer Destination IP address Next hop router s IP address Input interface s SNMP index Output interface s SNMP index Packets in the flow TCP/UDP source port number or equivalent TCP/UDP destination port number or equivalent IP protocol (for example, 6=TCP, 17=UDP) IP type-of-service AS of the source, either origin or peer AS of the destination, either origin or peer Source address prefix mask bits Destination address prefix mask bits http://www.cisco.com/en/us/docs/ios/11_2/feature/guide/netflow.pdf 22 August 2012 The Value of Flow Data for Peering Decisions - Hurricane Electric - Martin Levy Page 7
Why is flow data useful for peering? Flows can provide ASN-based information Mapping each flow to a src/dest ASN Counting data based on src and/or dest ASN pairs Some flow configurations also provide AS-PATH Mapping bits per second to ASN Providing insight into the bits flowing Flow data can also contain additional data IPv4/IPv6, protocol, src/dest IP address, src/dest port 22 August 2012 The Value of Flow Data for Peering Decisions - Hurricane Electric - Martin Levy Page 8
Peering? An example of useful flow data Consider a single Ethernet port at an IX Plot flow-data based upon destination peer ASN Instant view into the peering port (vs. traffic graph) AS#### AS#### AS#### AS#### 22 August 2012 The Value of Flow Data for Peering Decisions - Hurricane Electric - Martin Levy Page 9
Peering? Comparing more than one IX Consider a peer at more than one IX Plot flow-data for ASN based on peering location Instant view into the geographic spread Location 1 Location 2 Location 3 22 August 2012 The Value of Flow Data for Peering Decisions - Hurricane Electric - Martin Levy Page 10
Peering? Comparing more than one IX Consider a peer at more than one IX Plot flow-data for ASN based on peering location Instant view into the geographic spread Location 1 Location 2 Location 3 22 August 2012 The Value of Flow Data for Peering Decisions - Hurricane Electric - Martin Levy Page 11
Customer traffic port Customer traffic can be analyzed with ease Differentiate between transit and peering traffic Traffic via peering connections Traffic via transit connections 22 August 2012 The Value of Flow Data for Peering Decisions - Hurricane Electric - Martin Levy Page 12
Customer traffic port Customer traffic can be analyzed with ease Differentiate between traffic flowing to peers Traffic to all other peers Traffic via another peer Traffic via one peer 22 August 2012 The Value of Flow Data for Peering Decisions - Hurricane Electric - Martin Levy Page 13
Investigating Transit connections Analyze existing transit Decide next peer or who to buy more transit from Traffic to destination #1 Traffic to destination #2 Traffic to destination #3 Traffic to other destinations 22 August 2012 The Value of Flow Data for Peering Decisions - Hurricane Electric - Martin Levy Page 14
No graphical output an instant view Traffic b/w data vs. Flow b/w data Classic traffic graph Near instantaneous breakdown of peering bandwidths Inbound bandwidths Outbound bandwidths 22 August 2012 The Value of Flow Data for Peering Decisions - Hurricane Electric - Martin Levy Page 15
Flow software Two choices; both acceptable Commercial offerings Arbor Open Source offerings NfSen Your choice each has value 22 August 2012 The Value of Flow Data for Peering Decisions - Hurricane Electric - Martin Levy Page 16
Summary Flow data provides a view inside your pipes In/Out bandwidth numbers are not enough Using destination ASN or peer ASN is vital Peering ports come alive Transit and customer traffic finally understood No guesswork 22 August 2012 The Value of Flow Data for Peering Decisions - Hurricane Electric - Martin Levy Page 17
Q&A? Contact: Hurricane Electric 760 Mission Court Fremont, CA 94539, USA http://www.he.net/ sales at he dot net +1 (510) 580 4190 22 August 2012 The Value of Flow Data for Peering Decisions - Hurricane Electric - Martin Levy Page 18