Who Am I? Network Management Parallel Session. Contents. JANET(UK) Measurement & Monitoring. Netsight Contents. Contents

Transcription

1 Who Am I? Network Management Parallel Session Networkshop th April Leading JANET(UK) s Measurement and Monitoring work On secondment from STFC Daresbury Network performance, particularly Grid computing That s still part of the other job along with Daresbury network development, e.g X Copyright The JNT Association Optional 1 Copyright The JNT Association Optional 2 Contents Mark Leese JANET(UK) Mandatory JANET Measurement & Monitoring blah, blah, blah Responding to feedback from last year LAN monitoring with free tools DNS and DHCP David Round, University of Wales, Bangor Review of LAN Monitoring Tools Alex Clouter, School of Oriental & African Studies LanWarden - LDAP driven 802.1X, DHCP and DNS JANET(UK) Measurement & Monitoring Networkshop th April Mark Leese Copyright The JNT Association Optional 3 Copyright The JNT Association Optional 4 Contents Summary of JANET(UK) s M&M activities Netsight (90% of slides) Sorry if you ve seen these before but it s what people are asking about Network Flow monitoring (5%) Data for researchers (5%) Netsight Contents Original Netsight intro features New Netsight who it s for what it does what it doesn t do what it might do in the future Copyright The JNT Association Optional 5 Copyright The JNT Association Optional 6 1

2 Intro to Original Netsight Developed in-house Deployed Provides visibility of current and past performance on JANET Never used as a Network Monitoring System The NOC have their own systems Never intended as real-time, operational tool Who uses it? Provides end sites with visibility of core & their own connections Netsight type functionality for end sites is part of JANET SLA Can be used by RNOs But there s no requirement for them to use it Provides traffic data to assist JANET(UK) in various network performance reporting tasks, including parts of the SLA Similarly no requirement for us to use it, but we do because its useful On that basis, it s primarily for end sites Intro to Original Netsight Netsight provides traffic data It doesn t monitor outages because it can t Netsight uses ICMP ping False positives, e.g. sites stop their routers responding to pings So outages continue to be reported by RNOs in fault reports Netsight assists our network reporting functions It doesn t do SLA monitoring It merely provides traffic data which helps with the reporting requirements of the SLA and other reports ping data is only used internally Copyright The JNT Association Optional 7 Copyright The JNT Association Optional 8 Orig. Netsight Features Data Visibility JANET = Core + Regional Networks contracted to provide services to end sites Roughly one physical Netsight box per RN Each only has visibility of that RN s data If you want data for X regions, you have to login to X boxes Available Data Only ping tests + SNMP data from routers (traffic data) Orig. Netsight Features Data Granularity To save storage space older data is aggregated so we lose accuracy as time goes by E.g. for traffic measurements: we keep all data for the first 96 days (one measurement per 5 min period) after 96 days we keep just 2 values per day (an average of all the 5 minute values & the max value seen that day) This saves space but we lose any interesting data (e.g. spikes or troughs) that occurred on that day Data Analysis Netsight based on RRDTool Widely used, but not a database in the usual sense, so difficult to use for non-trivial analysis Copyright The JNT Association Optional 9 Copyright The JNT Association Optional 10 Intro to New Netsight Served its purpose well, but time to move on Work put out to tender Initial three years of service Optional extension(s) for up to two additional years Purpose A summary of the elusive purpose text JANET(UK) has a broad vision for its measurement and monitoring activities e.g. SJ5 project requirement to improve "visibility" of JANET performance data As a consequence, the new Netsight is built on powerful, extensible architecture In the immediate future, the new Netsight will be used to: a. provide end sites (and Regional Networks) with visibility of their own connections, b. provide network performance data for reporting purposes, c. provide data to assist network capacity planning Analysis of network flow data (NetFlow) is a separate project Copyright The JNT Association Optional 11 Copyright The JNT Association Optional 12 2

3 Who Is It For? As you were: End sites RNOs (you can, but you don t have to) JANET(UK) performance reporting people And hello to: Meeting the high-level SJ5 requirement to improve visibility of performance data, e.g. open up access to academic network researchers within JANET community: tightly controlled access within policy and legal framework made anonymous where appropriate Becta monitoring for schools Again it s not a Network Monitoring System, though that s not precluded in the future Improvements Thinking back to what we said about original Netsight Data Visibility, Analysis & Granularity Central, relational database (Oracle): All data available from one source Supports more powerful queries/analysis No aggregation of data no loss of detail over time Available Data Currently ping and SNMP as before But extensible to new types of measurements From Cisco IP-SLA nodes (e.g. jitter) Grid monitoring POSSIBLY network flow (NetFlow) data New measurements types + no loss of detail creates richer view of network performance Copyright The JNT Association Optional 13 Copyright The JNT Association Optional 14 IP-SLA Test functionality within IOS Using a simple Cisco router as dedicated test box Two master test nodes in the SJ core + small devices in Regional Networks & selected end sites More packets (than ping) in various test patterns Provides additional measurements, e.g. jitter Very hard to measure something like jitter with just 10 pings TCP, DNS and HTTP response time Gridmon UK infrastructure 20 nodes at Grid Computing sites They want to transfer lots of data around Like 10 million Gigabytes a year CERN) End-to-end measurements (PC to PC) Representative of what network performance real users see! Configuration change made to an Oxford departmental firewall Copyright The JNT Association Optional 15 Copyright The JNT Association Optional 16 Resilience of data collectors and user interface IPv6 capable Better graphing (more flexible selection of time scales) Schematic network maps: can be defined for regional and local areas clickable areas to drill-down for more local maps e.g. core core router region Super users can annotate graphs for particular paths, e.g. explain past outages User defined alert s (one a day) Scalable up to 30K organisations (schools?) Leeds-Warrington Copyright The JNT Association Optional 17 Copyright The JNT Association Optional 18 3

4 Leeds-Warrington Leeds-Warrington Copyright The JNT Association Optional 19 Copyright The JNT Association Optional 20 Copyright The JNT Association Optional 21 Copyright The JNT Association Optional 22 What It Doesn t Do As with the old Netsight, the new Netsight doesn t perform outage monitoring doesn t perform SLA monitoring Netsight is not NetFlow NetFlow is separate project We would like there to be linkage in the future, but it s not guaranteed Netsight is not primarily a research tool However, we want it to be capable of delivering performance data to academic research groups for further study Right now we can export CSVs of data shown on graphs Plans to provide more support in future Yes, anonymisation where appropriate Copyright The JNT Association Optional 23 Copyright The JNT Association Optional 24 4

5 JANET/ RNOs/... Data Gatherers Talks SNMP to routers & with Data Measurers Measurement Systems Remote Disk Backup Data Throughput Manager Measurement Database Delivery Sub-systems Web & web s configuration Reports... Initial version = ping tests. Adding measurement types requires new versions. Standby Database External Databases Flow monitoring CDF... Locations No longer require a box in each RNO Data Measurer and Data Gatherer at each of Bracknell, Warrington and Telecity Centralised for ease of management All measurements from core for easy comparison Distributed test nodes leads to meshes of tests, which can become messy data overload Telecity gives us transit time to where we peer with external networks Users Copyright The JNT Association Optional 25 Copyright The JNT Association Optional 26 Netsight Timeline New Netsight Conclusion 11 th Feb 31 st March Phased Rollout April-July end July Sept/Oct Initial system accepted. First year s maintenance begun System has equivalent functionality to original Netsight. Begin phased rollout to RNOs. JANET(UK) configure RNO and associated end sites on a per RNO basis: users, reporting paths, measurement jobs New and old systems run in parallel giving time for everyone to transition. Support contract for original Netsight systems expires. Last warning! Old Netsight systems become unavailable. Central, relational database: data available from one source more powerful analysis no aggregation/loss of detail Extensible: data from different providers can be imported to produce richer view of network performance New features: zoom-able graphs, alert s, annotations etc. Copyright The JNT Association Optional 27 Copyright The JNT Association Optional 28 Network Flow Monitoring JANET(UK) procuring new standalone system to analyse network flow data (e.g. Cisco NetFlow version 9 [rfc3954]) describes basic attributes of IP conversations that have been observed on the network We re writing requirements to cover wide range of uses: NOC, network operations CERT type activities trend analysis upgrade planning P2P vs. HTTP vs. VoIP vs. Videocon research accounting and reporting type functions Network Flow Monitoring Unsurprisingly, it s complex: From where do we take exported flow data? Currently we take flows from external peering routers. What about inside JANET? Massive amounts of data - even with sampling rate of 1 in 10 we already see peak exports of 40K flows/s from peering routers Steve Williams proposed architecture included extending access to RNOs and end sites Integration with Netsight would also be useful: correlate how much the network is being used (Netsight) with how it is being used (NetFlow) In reality, we can t say anything more on either until we know the chosen system Copyright The JNT Association Optional 29 Copyright The JNT Association Optional 30 5

6 Network Flow Timeline Aim to launch procurement summer Aim to review submissions autumn Realistic initial deployment available within JANET(UK) early-mid 2009 I can t be more specific yet Capabilities of procured solution will define what happens after that Data for Researchers High-level SJ5 requirement to improve visibility of performance data MASTS one example (Measurement at All Scales and TimeS) Cambridge, Loughborough, UCL Origins in studying the use of UKLight From my point of view, MASTS was about two things: 1. Developing an infrastructure to capture and archive traffic on a high-speed network 2. Using that infrastructure to create archive of activity on UKLight Provides data for researchers to validate theories or provide input to a simulation or study Once collected, the data can be used without need to further hassle network operators MASTS2 may look at analysing the captured data Copyright The JNT Association Optional 31 Copyright The JNT Association Optional 32 MASTS Plan to perform monitoring at: Telecity: traffic from JANET Lightpath JANET Co-Location at RAL: traffic from the CERN-RAL leg of the OPN Reading: traffic from JANET production IP service Optical Taps/Splitter Monitor a raw optical signal Passive tap steals a small proportion of the signal For MASTS, A = router and B = optical transmission kit This will likely be approach at RAL Data fed into specialised (Endace) PC network card, at up to 10 Gbit/s! Packet headers stripped off, buffered and backhauled to UCL at 1 Gbit/s (more fibre) into storage ready for anonymisation and analysis A 100% 80% 20% B JANET(UK) s role: Providing optical taps etc. = the easy bit Developing policy & legal framework = the not so easy bit Monitor Copyright The JNT Association Optional 33 Copyright The JNT Association Optional 34 Show Off s Optical Tap Glimmerglass Optical Switch 8 channel optical splitter Optical switch used to select the fibre we re interested in Supports deep monitoring of network MASTS will use this approach at Reading A B Arrays of micro-mirrors steer beams of light from fibre to fibre Switch any input port to any output port Can be controlled remotely Optical Switch Monitor 10 bonus points if you spotted that there s only 7 lines :-) Copyright The JNT Association Optional 35 Copyright The JNT Association Optional 36 6

7 Questions??? Copyright The JNT Association Optional 37 7