The ehealth Traffic Accountant Reporting Application

Transcription

1 Focus on Value The ehealth Traffic Accountant Reporting Application Understanding data (or traffic ) flow is essential for capacity planning and enabling a consistent level of performance particularly in dynamic networks that are subject to frequent upgrades and changes. The ehealth Traffic Accountant reporting application makes it easy to manage traffic for optimum performance by analyzing network traffic flows between the nodes in your network, and between autonomous systems. Enterprises can use this application for security, planning interdepartmental cost allocations, monitoring traffic, and diagnosing traffic problems. Traffic Accountant s autonomous system (AS) to AS support enables Service Providers to identify the most effective partners, incoming and outgoing traffic destinations, and the traffic that is simply passing through their network and not using the services that they provide. It shows how nodes and applications use your network. You can use this information to plan and implement network reconfiguration, growth, and security procedures and to relate network costs to the nodes and organizations that use the network. Traffic flow information is not only useful for understanding your network as part of capacity and performance planning, but it is also useful in assessing your infrastructure for its ability to handle applications requiring high performance and availability. Traffic management provides a detailed look at the environment in which the applications operate. Optimizing IT management by identifying the major users of the network. The Value of Traffic Accountant The ehealth Traffic Accountant offers the following benefits: Identify the Most Active Nodes By determining which nodes are most active in your network, you can easily isolate the source of network congestion and problems. Identify the Major Sources of Communication By determining which nodes communicate most with a particular department or location, you can provide additional bandwidth between high traffic areas to avoid congestion. Identify Your Dominant Applications By examining a breakdown of the total network traffic based on applications, you can allocate resources to provide the highest level of support and service for the applications being used most often. Effectively Manage Cost Allocations By analyzing the traffic distribution across the organization, you can determine which departments should share the cost burden. Monitor Variations in Traffic over Time By customizing a report, you can show variations in traffic over time, identify users who access an server or other application, and investigate traffic destinations. June 2005

2 Traffic Collection and Analysis Concepts ehealth Traffic Accountant discovers RMON2 probes installed in the network, collects traffic data from the probes, and consolidates the statistics. An RMON2 probe is a remote network monitoring device that analyzes traffic and summarizes the data by nodes, protocols, and applications. A probe can be a standalone device attached to the network segment or it can be imbedded into a network device such as a LAN switch or a router. In addition to supporting RMON2- compliant probes, ehealth Traffic Accountant also supports the Cisco NetFlow FlowCollector as a data source. A probe can only report on traffic that appears on the network segment to which it is attached. A probe can be used on both LAN and WAN segments. Thus, probes must be strategically placed throughout the network to provide coverage of the major conversations of interest. For example, a probe placed on the same segment as the Internet firewall can see and report on all traffic to and from the Internet. From a central site, a probe connected to the Frame Relay access port can report on all traffic on the PVCs coming into the central site. ehealth Traffic Accountant analyzes and breaks down the traffic as seen by each probe or Cisco FlowCollector according to three categories: nodes, conversations, and protocols. A node is any device in the network that has a network address (IP address, IPX address, or MAC address). A probe records the traffic volume generated by each node on the network segment. With this information, you can identify the top talkers of the network. A conversation is a data transfer between a pair of nodes. For example, the conversation between a workstation and a server might include a number of transactions such as file transfer, a TELNET session, and an HTTP transfer. For the probe to record the conversation, the traffic must pass through the probe segment. In other words, the sending node or the receiving node must reside on the probe segment, or the probe segment must be a transit segment (that is, a LAN or WAN line through which traffic passes). With information on the conversations, you can identify the top conversational partners of a specific node. A probe analyzes the traffic and accumulates statistics for each protocol, such as the number of bytes of IP versus IPX traffic. The upper-layer 2 protocol is usually associated with an application. In the case of IP, the application (for example, TELNET or FTP) is associated with a TCP or UDP port number. In the case of IPX, the application is usually associated with the socket number. With statistics for each application, you can identify the most prominent applications in the network. Figure 1 shows the deployment of probes in a typical network. In this example, Probe1 is a WAN probe connected to the Frame Relay port of the central router. It sees all traffic between the central site and branch offices. Probe2 sits on the server segment and sees all traffic to and from the servers. Probe3 sits on the Internet segment and sees all traffic to and from the Internet. If you place more probes on the remaining segments, you can collect more information about the network. The number of probes used usually represents a tradeoff between cost and the amount of information available to Traffic Accountant for analysis. Figure 1. Deployment of Probes in a Typical Network

3 Organizing Your Nodes to Analyze Traffic To report on the traffic statistics that your probes collect, you can organize your nodes into views and groups. A Traffic Accountant view contains groups of nodes associated with a particular location or department. Different views can offer different perspectives for analyzing the same traffic statistics. A Departmental view can include groups of nodes (or members ) that communicate with a particular department. This type of view allows you to compare the traffic volumes among departments within your organization, identify the departments that generate the most traffic, and those with which an organization communicates the most. For example, consider a network with nodes from A to Z. You can create a view called Department (Figure 2) to organize the nodes into groups based on departments that they support. These two views offer different perspectives for analyzing the same traffic statistics. When a report is generated, you can choose the view to use. In the departmental view, you can compare the traffic volumes of the different departments, or the departments with which the Engineering department communicates the most. In the location view, you can compare the traffic volumes of the different locations and pinpoint the location that generates the most traffic, or identify the locations with which one site communicates the most. In practice, a network typically has a large number of nodes. You can assign important nodes into groups based on subnet, IP address, or probe, and leave the rest as unassigned. The traffic statistics for these nodes will be added together and will appear in a group called Unassigned. As Traffic Accountant detects new nodes, it places them in the appropriate groups. The Traffic Accountant s large number of predefined reports combined with the ability to create customized reports provides IT/network managers with a powerful planning and troubleshooting tool. Figure 2. Departmental View You can then create a separate group for the same network called Location (Figure 3) by organizing the same nodes into groups based on their placement within your infrastructure. A Location view allows you to compare the traffic volumes among locations within your organization, identify the locations that generate the most traffic, and those with which an organization communicates the most. Generating Traffic Accountant Reports. You can generate reports to identify the nodes or groups that produce the most traffic and the organizations or locations that communicate the most often with each other. These reports can also identify the users who account for most of the traffic, the dominant applications, and the ways in which traffic varies over time. Traffic Accountant can generate a large number of reports grouped into three different categories: Quick Start Standard Customized Quick Start Reports. Quick Start reports are a predefined set of reports that you can run to answer the most commonly asked questions about network usage. Standard Reports. The standard reports are a comprehensive set of predefined reports that can provide detailed information about nodes, groups, views, probes, and the network. Figure 3. Location View Customized Reports. Customized Traffic Accountant reports can perform specific reporting tasks for your IT environment. You can create customized versions of the standard reports or new reports. For example, you can create a customized report that tracks the volume of Web (HTTP) traffic. 3

4 Identifying the Most Active Nodes If users experience slow response time, you can generate ehealth Health Reports to isolate the problem. In the sample report shown in Figure 4, the segment utilization was abnormally high. This caused excessive congestion and collisions. The Top Nodes For Group chart shown in Figure 5 displays the traffic volume generated by the most active nodes and the protocol breakdown of the traffic. A rarely used desktop server, jsmith, was one of the most active nodes. Since this is highly unusual, it is the likely cause of the network congestion in the group. In the scenario depicted in Figure 5, jsmith was identified as the node that generated an abnormal level of traffic. To investigate the problem further, we can identify the nodes with which jsmith communicated and the nature of the traffic, using the Most Active Nodes report. Figure 6 shows that a large percentage of the traffic was among jsmith, mailgw (the mail gateway), and dnsserver (the DNS server). This suggests that the high traffic volume was the result of an unusually high volume of traffic to and from jsmith. Note that this report can also be used to track and audit business-critical resources. For example, this report can be used to display the top conversations with the order processing server, allowing you to identify the main users of the server. You could also run a Node Conversation Log Text report to display the 50 largest node partners for a node and the applications used or the NodePartners For Node Trend chart to display the largest node partners for a node and when they communicated. Figure 4. Health Report Figure 5. Top Nodes for Group Chart Figure 6. Most Active Nodes Report 4

5 Identifying the Major Sources of Communication A common technique in network optimization is to identify the major communication partners and then provide additional bandwidth between high traffic areas. For example, to find out which groups communicate the most with the Engineering group, the GroupPartners For Group chart can be used. It shows the percentage of Engineering traffic with each of the group partners. Figure 7 shows that 61% of the traffic is intradepartment traffic (traffic from one Engineering node to another). Of the remaining traffic, 20% is between Engineering and Marketing. This information allows the network manager to optimize the network infrastructure by providing a direct communication path between them. You might want to connect the two groups with a bridge or router if they are in the same building or install a direct WAN link between the two groups if they are geographically separated. Another related report is the standard Group Conversation Log Text report that displays the 50 largest group partners for a specified group and the applications used. Identifying Dominant Applications In IT planning, it is very important to identify your dominant protocols and applications. This information allows the IT or network manager to allocate resources based on the nature of the traffic. The Quick Start Network Applications Used in Your Network report gives you a high-level view of the protocol distribution by showing a breakdown of the total network traffic by protocol. Figure 8 shows that the order processing application, a business-critical application, accounts for 28% of the total network traffic. The network must be designed in a way that provides the highest level of support and service for this application. This may include providing redundant servers or routing paths, dedicated bandwidth for this application, or applying QoS policies. Figure 7. Group Partners for Group Report Figure 8. Applications Used in Your Network 5

6 From a different perspective, it is also useful to determine the traffic breakdown by group. The TopGroups For View report displays the applications used by the most active groups. Figure 9 shows that Sales, Tech Support, and Finance are the three main users of the order processing application. To optimize the network, servers running the order processing application should be installed in each of the three main user groups. The chart also shows that as a group, Engineering generates the most network traffic. However, the composition of traffic may change depending on the time of day. To understand when an application is used the most, you can use the Application For Group Trend chart. The sample chart shown in Figure 10 was generated for the Engineering group. Figure 10 shows that even though FTP is the dominant application for Engineering, it is only used in the early hours after midnight. During the rest of the day, the dominant application is AppleTalk. This information can be very useful. For example, to speed up the response time of interactive traffic such as TELNET or order processing, a common technique is to use priority queuing in the router to assign TELNET or order processing traffic a higher priority at the expense of bulk transfer traffic such as FTP. However, the chart shows that since order processing and FTP traffic do not occur at the same time, this technique would be largely ineffective. Instead, lower priority should be assigned to bulk transfer traffic that occurs concurrently with order processing. Figure 9. Top Groups for View Bar Chart Figure 10. Applications For Group Trend Chart 6

7 Planning Cost Allocations Effectively In many companies, the cost of running the enterprise network is shared among departments based on the amount of traffic generated. Although Traffic Accountant is not a billing application, it is very useful for identifying the traffic distribution by groups to determine how monthly costs should be allocated. In Figure 11, the Allocation By Department report shows that the monthly cost of $527,894 could be split between the various departments based on the traffic distribution. In this example, Engineering consumed approximately 23% of the cost or $121,415. You can use Traffic Accountant to identify the major sources of traffic within a department by determining which servers are most frequently accessed. If some servers generate significantly more traffic than others, you might want to move them to dedicated switched ports to improve performance. To obtain this information, you can use the Group Activity Log Text report. Figure 12 shows that in the Engineering group, Server10, Mailgw, Server2, Server5, Dnsserver, and Figure 11. Allocation by Department Report Server1 are the busiest servers. You can use ehealth Health reports to determine if these servers have enough resources (bandwidth, processing power, memory, and disk space) to handle the load. Figure 12. Group Activity Log Report 7

8 Monitoring Variations in Traffic over Time If you are concerned about how your Web server is being used, you can track the users who frequently access it and ensure that they are using resources for the appropriate purposes during business hours only. To find out, you can create a customized report to show the variation of Web traffic over time for a particular Web application such as Microsoft Exchange. For example, the Daily Web Traffic report shown in Figure 13 indicates that traffic steadily increases throughout the day, but gets busy around noon and again from 8 p.m. to midnight. Most likely, most employees check their and reply to messages at lunchtime and again in the evening. This report can also be used to monitor compliance with corporate usage policies. For example, if the policy allows a particular application to be used during a certain time of day only, the chart shown in Figure 14 can be used to ensure that users adhere to the policy. To obtain more detailed information about the Web traffic destinations, you can use another customized report to list the top 10 servers. The chart shows that some users have been using excessively. Figure 13. Daily Traffic Report The Web Traffic Audit report provides more detail on Web access. It displays a record of the top 50 conversations that used HTTP. For each conversation, the report shows the node partners and the size of the conversation in bytes. The table shown in Figure 15 shows that jsmith is the top user and her traffic accounts for 20% of the total traffic. Figure 14. Top 10 Servers Report Figure 15. Web Traffic Audit Report 8

9 Traffic Accountant Report Summary Quick Start Reports Standard Reports Identify the nodes or groups that generate the most traffic: Probe - Top Talkers Seen Network - Top Talkers in Your Network Probe - Top Conversations Top Nodes For Group Bar Chart Top Nodes For Group Trend Chart Top Nodes Seen By Probe Trend Chart Top Nodes Among All Nodes Bar Chart TopGroups For View Bar Chart Top Nodes For View Bar Chart Identify who communicates with the node or group: GroupPartners For Group Pie Chart NodeToNodeConversations AllNodes Text Top Conversations Seen By Probe Text NodeToNodeConversations View Text Identify who accounts for what percentage of traffic: Node - Conversation with Other Nodes Allocation By Department Pie Chart Group Activity Log Text Group Conversation Log Text Node Conversation Log Text Identify the dominant applications: Node - Applications Seen Probe - Applications Seen Network - Applications Used in Your Network Applications For Group Trend Chart Applications For AllNodes Pie Chart Applications For Node Trend Chart Applications Seen By Probe Trend Chart Applications For View Pie Chart Identify who is using a critical resource: Node - Conversation with Other Nodes Web Traffic Audit GroupPartners For Node Pie Chart NodePartners For Node Trend Chart Analyze traffic variations over time: Network - TopTalkers in Your Network Network - Applications Used in Your Network Top Nodes For Group Trend Chart Top Nodes Seen By Probe Trend Chart Applications For Group Trend Chart Applications For Node Trend Chart Applications Seen By Probe Trend Chart NodePartners For Node Trend Chart Copyright 2005 Concord Communications, Inc. ehealth, the Concord Logo, Live Health, Live Status, SystemEDGE, AdvantEDGE and/or other Concord marks or products referenced herein are either registered trademarks or trademarks of Concord Communications, Inc. Other trademarks are the property of their respective owners. 9