- Test - lists.nanog.org

Re: NAP/ISP Saturation WAS: Re: Exchanges that matter...
by Tony Li 17 Dec '96

17 Dec '96

* ICMP packets are dropped by busy routers Many routers drop ICMP packets (ping, traceroute) when busy, or alternate dropping ICMP packets. I know that this behavior occurs when the packets are directed to the specific router, I am not sure if this every occurs for packets passing through. The standby tool ping needs a more reliable replacement for testing end to end packet loss. There seems to be a great deal of (understandable) confusion on this issue. Let's set it straight: Packets which are _successfully_ forwarded through a (high end) cisco router are not (by default) prioritized by protocol type. Packets which are not forwarded require more work and are effectively rate limited (and consume large amounts of CPU time). Some effects: - Pinging a cisco is not a valid measure of packet loss. It's closer to a CPU load measure than anything else. - Pinging _thru_ a cisco is reasonable. - Traceroute to a cisco is rate limited to one reply per second, so will almost always miss the middle reply. - Traceroute _thru_ a cisco may show many drops which would NOT be seen by normal "thru" traffic. Replies generated by the cisco when the TTL expires are again thru the CPU. So you may well traceroute thru a cisco which does not reply at all. However, you can clearly see the route after that router. * Head of queue blocking in the Gigaswitch Even though the Gigaswitch has input and output queues, your output queue will block until the other providers input queue is free. My (admittedly second hand) understanding is that the Gigaswitch/FDDI actually has minimal amounts of buffering. During a congestion event, it simply withholds the token, resulting in buffering in the routers. Queues there eventually overflow, and ... If this is incorrect, I would greatly appreciate pointers to the truth. Tony

3 2

Re: Exchanges that matter...
by salo＠msc.edu 17 Dec '96

17 Dec '96

> Subject: Re: Exchanges that matter... > Date: Fri, 29 Nov 1996 11:02:24 -0800 > From: Paul A Vixie <paul(a)vix.com> > [...] > ... and they aren't subject to ATM's cell tax ... I am surprised, (well, maybe not), that you aren't concerned about the excessive overhead present in FDDI networks... -tjs From: salo(a)msc.edu (Tim Salo) Date: Tue, 23 Jul 1996 14:50:11 -0500 (CDT) > Date: Tue, 23 Jul 1996 14:28:27 -0400 > From: Paul Ferguson <pferguso(a)cisco.com> > [...] > Recall Jerry Scharf's numbers; they're indicative of the issue. > [...] > HDLC framing bytes = 3080633605 HDLC efficiency = 97.72 > ATM framing bytes = 3644304857 ATM efficiency = 82.61 > ATM w/snap framing bytes = 3862101043 ATM w/snap efficiency = 77.95 At a certain point, some of these arguments about ATM efficiency sound a bit like saying FDDI is terrible because 4B/5B encoding is only 80% efficient. I think a more interesting measure of the value of ATM versus other wide-area technologies is some sort of measure of throughput per dollar.

11 12

Re: NAP/ISP Saturation WAS: Re: Exchanges that matter...
by salo＠msc.edu 16 Dec '96

16 Dec '96

> To: salo(a)msc.edu (Tim Salo) > Date: Mon, 16 Dec 1996 17:16:40 -0500 (EST) > From: dvv(a)sprint.net (Dima Volodin) > [...] > > So, do I understand you correctly as saying that you have no interest > > in helping your customers understand the state of your service? > > No, I neither have said nor intend to say anything like that. Yes, I was being a bit unfair. Rather, I should have asked: "How do you recommend that your customers proactively monitor the status of your network and the wider Internet?" I took a quick look at the SprintLink handbook, but probably missed the recommendation. -tjs

1 0

Re: NAP/ISP Saturation WAS: Re: Exchanges that matter...
by salo＠msc.edu 16 Dec '96

16 Dec '96

1 0

Re: NAP/ISP Saturation WAS: Re: Exchanges that matter...
by Sanjay Dani 16 Dec '96

16 Dec '96

> From: dvv(a)sprint.net (Dima Volodin) > More of that - at least one site uses one of our hosts as a target of > pings for measuring "Internet health". > We consider this to be an abuse of our resources Perhaps they are evaluating you against other backbone providers by sending an icmp packet every few minutes. Is that still considered abuse or an incentive to you to potentially gain business by keeping your sites up all the time? Our potential clients evaluate us by visiting our web site to just see the performance. Sanjay.

1 0

Re: NAP/ISP Saturation WAS: Re: Exchanges that matter...
by salo＠msc.edu 16 Dec '96

16 Dec '96

> Subject: Re: NAP/ISP Saturation WAS: Re: Exchanges that matter... > To: doleary(a)cisco.com (dave o'leary) > Date: Mon, 16 Dec 1996 16:00:09 -0500 (EST) > Cc: mleber(a)he.net, forrestc(a)iMach.com, nathan(a)netrail.net, joe(a)Navigist.Com, > nanog(a)merit.edu > From: dvv(a)sprint.net (Dima Volodin) > > More of that - at least one site uses one of our hosts as a target of > pings for measuring "Internet health". > We consider this to be an abuse of our resources How many ping per second do you see? How many pings per second can your host handle? Your network? > and, most probably, we will disable any external > traffic we find inappropriate for this or other hosts. So, do I understand you correctly as saying that you have no interest in helping your customers understand the state of your service? -tjs "Those darn customers, things would work just fine, if they didn't keep using the network..."

2 1

Re: [Announce] traceroute sites
by Jason Fesler 16 Dec '96

16 Dec '96

Likewise, http://www.calweb.com/cgi-bin/trace has existed for quite a while. One of my next goals is to start saving traceroute data that it gets it with, and have it build a map with the given data.. Hard part will be making it pretty when starting with just ascii data :-). >> >traceroute url: >> >http://www.cwix.net/cgi-bin/trace -- Jason Fesler jfesler(a)calweb.com Internic: 'whois jf319' Admin, CalWeb Internet Services http://www.calweb.com Junk email returned, in bulk, back to sender; w/copies to all postmasters. You got junk mail problems? Use Eudora Pro, MSIE's mail, or 'man procmail'.

3 2

Re: Nanog list uncharacteristically quiet?
by Paul Ferguson 15 Dec '96

15 Dec '96

This is pretty much consistent with flow-data that I have seen from other places in the net. - paul At 12:04 PM 12/15/96 -0700, Brett D. Watson wrote: > >core1.sjc1#sh ip ca f >IP packet size distribution (219413380 total packets): > 1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480 > .000 .388 .040 .014 .017 .014 .023 .013 .030 .026 .014 .010 .004 .004 .004 > > 512 544 576 1024 1536 2048 2560 3072 3584 4096 4608 > .044 .003 .143 .000 .102 .097 .000 .000 .000 .000 .000 > >IP Flow Switching Cache, 22757 active, 42779 inactive, 9734878 added > 0 flows exported, 0 not exported, 0 export msgs sent > 5 cur max hash, 13 worst max hash, 20773 valid buckets > 0 flow alloc failures > statistics cleared 36123 seconds ago > >Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) >-------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow >TCP-Telnet 15886 0.4 159 78 70.1 97.7 44.3 >TCP-FTP 175819 4.8 6 72 31.0 6.1 45.9 >TCP-FTPD 34862 0.9 280 591 270.4 82.3 44.7 >TCP-WWW 5135690 142.1 20 391 2848.3 12.3 45.9 >TCP-SMTP 179682 4.9 18 178 94.0 7.1 45.8 >TCP-X 838 0.0 157 127 3.6 86.3 45.4 >TCP-BGP 4298 0.1 90 113 10.7 322.8 39.4 >TCP-Frag 679 0.0 19 733 0.3 22.0 45.2 >TCP-other 399609 11.0 181 411 2008.3 65.7 44.9 >UDP-DNS 2411976 66.7 5 132 339.2 14.9 45.5 >UDP-NTP 164740 4.5 2 76 9.4 1.2 45.9 >UDP-TFTP 2 0.0 2 69 0.0 0.0 59.8 >UDP-Frag 42 0.0 2747 173 3.1 436.4 35.7 >UDP-other 759665 21.0 22 227 466.6 7.5 45.5 >ICMP 429570 11.8 7 88 93.3 19.8 44.7 >IGMP 85 0.0 1707 102 4.0 1670.4 6.2 >IPINIP 370 0.0 13 114 0.1 55.0 45.1 >GRE 119 0.0 245 139 0.8 1810.6 4.0 >IP-other 1490 0.0 31 123 1.2 64.0 43.9 >Total: 9715422 268.9 23 365 6256.0 15.3 45.7 > > > web flows obviously beat the pants off of most everything else (big >surprise). it seems odd to me that idle seconds/flow are pretty much >equal regardless of the protocol. bytes/packet is under 500 >(average) for just about all protocols. lots of tiny packets >floating around. > >-brett >

1 0

Re: Nanog list uncharacteristically quiet?
by Vadim Antonov 15 Dec '96

15 Dec '96

>Here's something to chew on. As an end-node site who has recently become >triply-homed I've been wondering whether it would be useful if routers had >a way of making a route selection based on output queue levels. Not. That will cause reordering of packets, and so trigger false TCP retransmits. >Ie., let's say I have 2 paths to a destination of equal as-path distance >through neighbor A and neighbor B. Based on recent discussion it sounds >like IOS will send the packet to the neighbor with the lowest IP address. Not. This is a default tie-breaking rule in cisco's BGP implementation, and doesn't have anything to do with packet forwarding. --vadim

5 5

Re: Nanog list uncharacteristically quiet?
by Brett D. Watson 15 Dec '96

15 Dec '96

> On Sat, 14 Dec 1996, Mike Leber wrote: > > |} Has anybody collected stream duration data? What does the distribution > |} look like? 98% of streams last how long? (I bet less than 5 minutes) > |} I think something like this was brought up at the Ann Arbor NANOG. > > What are you calling a 'stream' ? People are starting to collect flow > data in quite a few places with some interesting results. > > > -jh- > we've been running netflow for a few weeks now. we dont' have all the data collection working yet and havent' done any real analysis yet but in case anyone is interested in a single viewpoint from our backbone, here's a snapshot of the netflow cache on our core router in san jose: core1.sjc1#sh ip ca f IP packet size distribution (219413380 total packets): 1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480 .000 .388 .040 .014 .017 .014 .023 .013 .030 .026 .014 .010 .004 .004 .004 512 544 576 1024 1536 2048 2560 3072 3584 4096 4608 .044 .003 .143 .000 .102 .097 .000 .000 .000 .000 .000 IP Flow Switching Cache, 22757 active, 42779 inactive, 9734878 added 0 flows exported, 0 not exported, 0 export msgs sent 5 cur max hash, 13 worst max hash, 20773 valid buckets 0 flow alloc failures statistics cleared 36123 seconds ago Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) -------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow TCP-Telnet 15886 0.4 159 78 70.1 97.7 44.3 TCP-FTP 175819 4.8 6 72 31.0 6.1 45.9 TCP-FTPD 34862 0.9 280 591 270.4 82.3 44.7 TCP-WWW 5135690 142.1 20 391 2848.3 12.3 45.9 TCP-SMTP 179682 4.9 18 178 94.0 7.1 45.8 TCP-X 838 0.0 157 127 3.6 86.3 45.4 TCP-BGP 4298 0.1 90 113 10.7 322.8 39.4 TCP-Frag 679 0.0 19 733 0.3 22.0 45.2 TCP-other 399609 11.0 181 411 2008.3 65.7 44.9 UDP-DNS 2411976 66.7 5 132 339.2 14.9 45.5 UDP-NTP 164740 4.5 2 76 9.4 1.2 45.9 UDP-TFTP 2 0.0 2 69 0.0 0.0 59.8 UDP-Frag 42 0.0 2747 173 3.1 436.4 35.7 UDP-other 759665 21.0 22 227 466.6 7.5 45.5 ICMP 429570 11.8 7 88 93.3 19.8 44.7 IGMP 85 0.0 1707 102 4.0 1670.4 6.2 IPINIP 370 0.0 13 114 0.1 55.0 45.1 GRE 119 0.0 245 139 0.8 1810.6 4.0 IP-other 1490 0.0 31 123 1.2 64.0 43.9 Total: 9715422 268.9 23 365 6256.0 15.3 45.7 web flows obviously beat the pants off of most everything else (big surprise). it seems odd to me that idle seconds/flow are pretty much equal regardless of the protocol. bytes/packet is under 500 (average) for just about all protocols. lots of tiny packets floating around. -brett

1 0