1 / 28

SURFnet6 Network Monitoring and Reporting

SURFnet6 Network Monitoring and Reporting. Hans Trompert, SURFnet. Information needs. Annual report. Information detail. Connected organizations. NOC / SURFnet / research. Monitoring versus Reporting. Monitoring real-time status alarms Reporting afterwards

delora
Download Presentation

SURFnet6 Network Monitoring and Reporting

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. SURFnet6 Network Monitoring and Reporting Hans Trompert, SURFnet

  2. Information needs Annual report Information detail Connected organizations NOC / SURFnet / research

  3. Monitoring versus Reporting • Monitoring • real-time • status • alarms • Reporting • afterwards • over a specific time period (day, week, month, year)

  4. Avici SSR SURFnet6 operations Nortel ERS8600 Nortel OM5200 Real-time customer reporting Nortel OME6500 Nortel OME1060 Security Information source and destination

  5. Equipment and interface

  6. Reporting: SNMP metrics SNMP metrics: • Interface in/out octet counters • Interface in/out packet counters (unicast/broadcast/multicast) • Interface input/output errors • Interface availability • Temperature • Memory • CPU • Device uptime • and more …

  7. Reporting: TL1 metrics TL1 metrics: • Input/Output Frames • Errored frames • Discarded frames • Transmit and receive power levels • Errored Seconds - number of seconds that have had CRC errors • Severely Errored Seconds - after 10 seconds of ES we start counting SES • UnAvailable Seconds - Seconds where we had no sync • and more …

  8. Monitoring: SNMP traps SNMP traps • Fan • Temperature • Voltage • Link Up/Down • Bay Controller • Module • PIM + MSDP • BGP • VRRP • ISIS • and more …

  9. Monitoring: TL1 events TL1 Events • Equipment • Circuit pack missing/mismatch/failed • Fan failed/missing • Power failure A or B • High temperature • Shelf • Software upgrade failed/mismatch/…. • Database integrity fail/restore in progress/… • Amplifier • input/output loss of signal • automatic shutoff • and many, many more

  10. Internet Border router Amsterdam1 (SARA) Border router Amsterdam2 (TeleCity II) Core router Amsterdam1 (SARA) Core router Amsterdam2 (TeleCity II) Connected organizations SNMP based volume reporting • Total external traffic • Per traffic class (AMS-IX, Global, privat peers) • Per provider/peer • Total SURFnet internal traffic • Per connected organization

  11. SURFnet external traffic volume • SURFnet external traffic volume • Ams-IX • Private peers (via Ams-IX), including: • Chello, Tiscali, @Home, Planet, XS4all • Garnier Projects, Abovenet , UUnet, Cogent • NREN • Geant2 • SINET • Abilene • Global • Global Crossing • Cable & Wireless

  12. SURFnet external traffic volume

  13. SURFstat: Real-time connected organization traffic volume reporting • Software • Net-SNMP • Python • RRDtool • Features • Easy administration by labeling connections with keywords in interface description on router • Different graph resolutions: day, week, month, year, decade • 1 minute measurement interval • Reports on • volume (bits in/out) • packets (unicast/multicast/broadcast)

  14. SURFstat: UvA (many users)

  15. SURFstat: CWI (few users)

  16. Netflow – flow information • Netflow uses the common 5-tuple definition, where a flow is defined as a unidirectional sequence of packets all sharing all of the following 5 values: • Source IP address • Destination IP address • Source TCP port • Destination TCP port • IP protocol • Most common fields in Netflow record: • 5-tuple information • Input and output SNMP interface index • Timestamps for the flow start and finish time • Number of bytes and packets observed in the flow

  17. Netflow – versions v1 First try v5 Most used version v6 Encapsulation information v7 Switch information v8 Several aggregation forms v9 Template Based, allowing many combinations, supports IPv6 IPFIX aka v10; IETF Standardized NetFlow 9 with Enterprise fields and other community input

  18. Internet Border router Amsterdam1 (SARA) Border router Amsterdam2 (TeleCity II) Core router Amsterdam1 (SARA) Core router Amsterdam2 (TeleCity II) Connected organizations Netflow setup FLOWmon PeakFlow perfSONAR Fan out NFSEN test

  19. Netflow applications • connected organizations: • FLOWmon detailed traffic reporting • SURFflow (Arbor Peakflow / NFSEN) suspicious traffic pattern reporting • SURFnet-CERT: • NFSEN suspicious traffic pattern reporting historical flow data queries profiles for custom reports • Geant2 JRA1 perfSONAR probes • Flow Subscription Measurement Point • Flow Selection and Aggregation Measurement Archive

  20. FLOWmon Detailed traffic reporting: • total traffic • prefix-based flow grouping • reports on: • IP version (v4/v6) • IP protocol (TCP, UDP, ICMP, GRE, …) • TCP port (HTTP, SMTP, NNTP, FTP, SSH, …) • UDP port (domain, RTSP, VPN, …) • top N connected organizations • destination AS traffic

  21. UvA traffic by IP protocol

  22. Connected organization to world traffic by TCP destination port

  23. SURFflow Reports on suspicious traffic patterns like: • Unusual amount of flows  DOS attack • Flows from one host to many ports on other host  portscan • From 1 host to same port on many hosts  break-in attempt making use of known bug • From many hosts to specific (set of) port(s) to many other hosts  virus/worm • etc …

  24. Active measurements: RTTPL Round Trip Time and Packet Loss monitoring • measurement probes throughout the network • central storage of results • active measurements by injecting ICMP echo request packets • measuring min/max/avg RTT and jitter • both IPv4 and IPv6 • both unicast and multicast (under development) • measuring packet loss • 20 pings per minute • report matrices per minute/hour/day/month • results between two probes in graphs

  25. RTTPL report matrices

  26. RTTPL Nijmegen - Amsterdam

  27. Active measurements: Connected organization availability • measuring availability by sending ICMP Echo Requests to connected organization router • measurement includes last mile to connected organization plus connected organization router port (unlike commercial providers) • Cisco routers with Service Assurance Agent software on both Amsterdam1 and Amsterdam2 • results stored in database and reported monthly • redundancy in measurements by ORing results from Amsterdam1 and Amsterdam2

  28. Thank you

More Related