Department of Electronic and Electrical Engineering, Loughborough University

Transcription

1 SMDS PEFOMANCE MONITOING : TAFFIC GENEATION, INFOMATION POCESSING & ANALYSIS Omar Bashir, Iain Phillips & David Parish + Abstract Many aspects of the performance of data communication networks can be determined from the delay experienced by the packets and the number of packets lost and duplicated during communication. These characteristics are generally determined by monitoring the network links intrusively using dedicated monitoring equipment. The intrusively monitored data are usually not retrieved by the existing network management protocols (e.g. SNMP) and therefore do not form part of the basic Management Information Base (MIB). Thus the generation of test traffic, the management of measurement data and processing and analysis of performance information demand special consideration. This paper describes an extensive network performance monitoring environment developed at Loughborough University. This includes the description of the monitoring apparatus, test methodology, database architecture, information structures, processing algorithms and analysis procedures. 1 Introduction The delay, loss and duplication characteristics of data communication networks can be determined by intrusively monitoring the network links. In the most basic form, a transmitting test station composes special time stamped test packets and transmits these towards a receiving test station at a regular rate. The receiving test station logs the arrival of these test packets. The number of test packets lost and duplicated and the delay they experience indicate the performance of the monitored links with respect to the traffic on these links. The clocks at both the test stations need to be synchronised so that accurate packet delay information may be calculated. This synchronisation may be achieved by acquiring timing information from external global timing agencies, for e.g. the ugby Clock 1 or the Global Positioning System 2. Alternately the time and the frequency offset of the remote clocks may be estimated using techniques such as least square regression analysis as described by oppel 3. Monitor Station Data Summary Generator Summaries Incidents Status and Configuration Analysis Incident Correlation Figure - 1 : Monitoring and Analysis Effects The task of monitoring a distributed system does not end at data collection. Data collection is viewed as the lowest level of the entire monitoring process 4. The collected data needs to be summarised appropriately. Summary derivation is a computationally intensive process. Issues that need to be addressed at this stage include the type of summaries that need to be derived and appropriate levels of granularity. These summaries are analysed in conjunction with the primitive data and the network configuration and status information. This allows different network events or incidents that occurred over monitored links to be detected. These include events such as excessive packet losses, significant delay variations, loss of service etc. ecurring and correlated incidents are categorised into network effects (Figure - 1). + Department of Electronic and Electrical Engineering, Loughborough University

2 The test stations are generally low cost platforms dedicated to collecting the primitive performance data. The primitive performance data are periodically downloaded to a separate control and data processing workstation for processing and analysis of the historical performance information. This workstation may also be used to control the test stations. The receiving test station may communicate the details of each received test packet to an alarm station. The alarm station may log only sufficient information to perform real time determination of error conditions and faults such as excessive delays and losses (Figure - 2). This paper describes a scalable distributed monitoring system that has evolved from the systems described by Phillips et al 2,5. This system is currently being used to monitor different links of the BT's Switched MultiMegabit Data Service (SMDS) wide area network. 2 Monitoring Apparatus & Testing Methodology Different sets of test stations are used to conduct different types of tests on the same or different parts of the network. One test varies from another on the basis of the test traffic (e.g. test packet size, sampling rate etc.) and the routes monitored. The test traffic consists of time stamped UDP/IP packets. eceived Test Packet Data eceive eceiving Test Station Alarm Station eceived Data Logs Control Information eceived Test Packet Control & Data Processing Stn Monitored Transmitted Data Logs Control Information Transmitted Test Packet Transmitting In order to provide a cost effective solution to the distributed monitoring problem, the test station hardware needs to be inexpensive. The monitoring system described here uses IBM 386 and 486 PCs executing the test programs under DOS. These test stations are dedicated to the generation and measurement of test traffic. Each set of test stations is managed usually by a separate control and data processing workstation. The test stations use Ethernet as the access network to the SMDS. Each test station uses a custom timing card to Figure - 2 : Monitoring System provide accurate timing information. The timing card uses a GPS receiver for timing synchronisation between remote test stations. This timing card is capable of providing time of day information accurate to 10 microseconds 5. The control and data processing workstations execute software to manage the test stations, process the performance measurements and analyse this information to detect various network performance trends, events and faults. Test station management activities include scheduling of tests, termination of tests, retrieval of logs, deletion of unwanted logs, execution of test station BIT (Built In Test) at regular intervals and recovery of a crashed test station. Walsall Suite GPS Suite Loughborough LEGEND : Control & Data Processing Workstation : AS : Alarm Station : outer Megastream Links Oxford Brookes SMDS AS Walsall Focused Lancaster Backup Figure - 3 : BT's SMDS Monitoring Infrastructure This requires the control and data processing workstation to be a high performance platform with significant disk space to manage enormous amounts of primitive data and processed information. SUN workstations and Pentium PCs using the Solaris operating system are generally used as control and data processing workstations. Currently Loughborough University is operating 2 monitoring suites. One suite consists of 3 test stations located at the BT Operations Centre at Walsall (Walsall Suite). These test stations are connected to five routers via an Ethernet. These routers are connected via Megastream links to 5 geographically separate points on the SMDS, Birmingham, Bristol, Edinburgh, London and Manchester 2. Transmit

3 One of these test stations performs 40 background tests on the links between the above mentioned sites. Another test station is used as a backup test station but can be used with the third test station to perform focused tests on a subset of the above mentioned links with higher sampling rates. Sophisticated focused tests can be conducted at sub-second granularities to detect fine grained network effects such as short breaks. These test stations are controlled from Loughborough by a SUN Sparc10 workstation. ecently a Pentium PC has been configured as a control and data processing workstation and installed at Walsall. This allows the BT staff to locally manage the focused test operations. This set-up also includes an alarm station developed by BT esearch Labs. This alarm station provides real time indication of network faults (Figure - 3). The second suite consists of three test stations at Loughborough University, Oxford Brookes University and Lancaster University respectively (GPS Suite). These test stations test the local access networks as well as the links between these sites. A SUN UltraSparc at Loughborough is used as a control and data processing workstation for this suite (Figure - 3). 3 Information Processing & Management In the simplest case, a number of information processing applications access a common primitive database to generate the required results. Most of the applications processing network performance data proceed through a number of similar processing stages. Some of these applications require information that can be generated by other applications. In such situations it may be tempting to access the information that has already been derived by other applications to generate the required information (Figure - 4). However it is important to note that most of the information processing applications generally have significantly shorter lives than the data they process. These may be developed to satisfy short term requirements or may be modified frequently to provide different information elements. Monitoring System Monitored Data Merge Interface App 1 App 2 App 3 Figure -4 : Information Sharing Across Applications The performance information requirements for different network management activities vary significantly. In some cases (for example research and development) the processing requirements may be extremely dynamic and may not be known accurately during the system analysis stage. Moreover the network performance analysis is an iterative process. Analysis of performance summaries usually generate further information requirements. These may dictate the derivation of different summaries at various levels of granularity. Monitoring System Monitored Data Merge Intermediate Information Generator Applications Interface Intermediate Information Base Figure - 5 : Information Processing based on Intermediate Information App 1 App 2 App 3 Thus designing the information processing component of the monitoring system on the basis of a few applications may be a short sighted decision. If some applications change, others may be adversely effected. The efficiency of the information processing algorithms and applications can be enhanced significantly by employing reusable information structures. This is accomplished by preprocessing the primitive data so that these can fulfil multiple information requirements. These pre-processed or intermediate information elements are derived at the finest possible level of granularity and are cached in the Intermediate Information Base (Figure - 5). These elements can be combined appropriately to generate intermediate information at the required levels of granularity. As multiple information requirements can be fulfilled directly from the pre-processed intermediate information, access to the primitive database is reduced significantly, thus enhancing the efficiency of the information processing applications.

4 esearch has previously been conducted towards the reusability of statistical summaries in databases and information processing systems 6,7. However most of this work is aimed at reusing additive summaries and summaries that can easily be decomposed into additive primitives. Unfortunately some of the information elements required for valid analysis applications are not additive in nature (e.g. percentiles). To overcome this, a flexible intermediate information structure is needed. The frequency distribution of test packet delays (Delay Distributions) for a specific analysis window represents such an intermediate information element 8. Frequency distributions along with the corresponding cumulative frequency distributions can be used to derive several additive and non-additive statistical summaries such as different averages, variances and percentiles. Moreover Delay Distributions derived for smaller non-overlapping windows can be added to provide Delay Distributions for a larger analysis window, if the granular Delay Distributions contain equal numbers of bins of the same bin size. Thus reusing Delay Distributions to derive the required packet delay summaries is more efficient than deriving the same summaries directly from the primitive data. The accuracy of information derived from a Delay Distribution is dependant on its bin size. Errors are significant for larger bin sizes (and therefore fewer bins) but decrease with an increase in the number of bins. Counts of lost and duplicated packets are additive in nature. These summaries pre-processed for smaller nonoverlapping windows may simply be added to provide packet loss and duplication summaries at coarser levels of granularity. 4 An Example Test Session Figures 6 and 7 show the results of monitoring the network link between Loughborough and Lancaster as well as the local links. The test stations at the respective Universities were set up to conduct 4 tests each. Two different test packet sizes were used, i.e. 64 bytes and 1500 bytes. Test packets were transmitted at a rate of one per second (one test packet per test every 4 seconds). Average Delay (Microseconds) / 4/ 1/ / 4/ 1/ / 4/ 1/ / 4/ 1/ / 4/ 2/ / 4/ 2/ / 4/ 2/ / 4/ 2/ / 4/ 3/ / 4/ 3/ / 4/ 3/ / 4/ 3/ / 4/ 4/ 0.00 Lancaster to Loughborough Loughborough to Lancaster 1997/ 4/ 4/ 6.00 Lancaster Local Loughborough Local Figure - 6 : Average Delay of 95% Fastest 64 Byte Packets 1997/ 4/ 4/ / 4/ 4/ / 4/ 5/ / 4/ 5/ / 4/ 5/ / 4/ 5/ / 4/ 6/ / 4/ 6/ / 4/ 6/ / 4/ 6/18.00 Average Delay (Micro-seconds) / 4/ 1/ / 4/ 1/ / 4/ 1/ / 4/ 1/ / 4/ 2/ / 4/ 2/ / 4/ 2/ / 4/ 2/ / 4/ 3/ / 4/ 3/ / 4/ 3/ / 4/ 3/ / 4/ 4/ / 4/ 4/ / 4/ 4/ / 4/ 4/18.00 Lancaster to Loughborough Loughborough to Lancaster Lancaster Local Loughborough Local Figure - 7 : Average Delay of 95% Fastest 1500 Byte Packets 1997/ 4/ 5/ / 4/ 5/ / 4/ 5/ / 4/ 5/ / 4/ 6/ / 4/ 6/ / 4/ 6/ / 4/ 6/18.00 The local links were tested by transmitting test packets with Ethernet address of the local routers but the IP address of the generating test station. On reception, the routers would re-transmit these test packets back to the test stations that generated them. The LAN at Loughborough is a special network connecting few hosts. The LAN at Lancaster is the main network used by the Computer Centre and therefore has a significant amount of traffic on it. The results show two distinct effects. One is the time of day variation of the delay. This effect is more prominent on the LAN at Lancaster due to the relatively large amount of traffic on it. Moreover the average delay experience by test packets on that network is higher than that experienced by test packets on the Loughborough local network. It can also be seen that the delay experienced by the test packets travelling over the wide area connections is affected significantly by the performance of the local links. The delay variations on the wide area connection correspond to the delay variations on the Lancaster LAN.

5 5 Conclusions The experience gained in operating the above mentioned systems has provided significant information for the future research and development of network performance monitoring architectures and methodologies. Loughborough University is currently developing a portable monitoring system for BT. It consists of two portable based monitor stations and a portable Pentium based control station. This system will assist in monitoring the end to end network performance from subscribers' sites. This information will help troubleshooting performance problems experienced by specific subscribers. Some experimental test stations at Loughborough are being used as test beds to develop software components and algorithms for an adaptive monitoring system 9. This system uses a central software component that can automatically initiate tests on the basis of user queries as well as the results of previous tests. Moreover the system will also be capable of disseminating the performance information appropriately to users and other computing platforms performing various network management activities. eferences 1. Siddiqui, M H: " Measurement Methodology for Integrated Services s", PhD thesis, Loughborough University of Technology, Phillips, I, Parish, D J, and odgers, C: " Measurements of the SMDS", IEE Colloquium on SMDS, London, October oppel, C: "In-service Monitoring Techniques for Cell Transfer Delay and Cell Delay Variation in ATM s", High ing edited by. Puigjaner, Chapman & Hall, 1995, pp Jain, : "The Art of Computer Systems Analysis : Techniques for Experimental Design, Measurement, Simulation and Modelling", John Wiley & Sons, Phillips, I, Tunnicliffe, M, Parish, D J and odgers, C: "On the Monitoring and Measurement of Quality of Service of SuperJanet", 13 th Teletraffic Symposium, Strathclyde, March Mumick, I S, Quass, D, and Mumick, B S: "Maintenance of Data Cubes and Summary Tables in a Warehouse", SIGMOD 97, Lenz, H, and Shoshani, A: "Summarizability in OLAP and Statistical s", SSDBM 97, Bashir, O, Phillips, I, and Parish, D: "Warehousing Communication Monitoring Data", IEE Colloquium on IT Strategies for Information Overload, London, December Phillips, I, Bashir, O, and Parish D: " Monitoring of s : Architecture, Operation and Dissemination", Presented at the BT's UI (University esearch Initiative) Workshop, University College London, April 1997.