----- Original Message ----- From: "Mark Milhollan" <mlm@ftel.net> To: <nanog@merit.edu> Sent: Friday, July 28, 2000 1:41 AM Subject: Re: recent internet packet size samples
Bill Woodcock writes:
I'm interested in seeing the distribution of packet sizes across a 1500-byte-constrained measurement point, with "real internet traffic" going past (for some reasonable interpretation of that phrase).
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) -------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow Total: 758613841 176.6 2 1170 440.8 6.1 14.6
I.e., on cisco routers with "Flow switching" enabled on all interfaces you want data included from, the router will give you that ...
show ip cache flow IP packet size distribution (1242M total packets): 1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480 .001 .436 .050 .018 .012 .008 .006 .005 .004 .005 .004 .006 .004 .003 .004
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608 .003 .003 .071 .030 .318 .000 .000 .000 .000 .000 .000 [...] Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) -------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow [...] Total: 55814697 43.4 22 581 965.3 5.1 7.9
Indeed, if you use the export mechanism you can capture the details behind this summary and analyze it pretty much as you like.
#ip flow-export destination cflowd-machine #ip flow-export version 5
It seems the packets size varied greatly, the first one is 1170, the second is 581, while I sample my core network, and get 290. You will find there is some discrepancy between the direct result 581, and if you calculate probability size from the packets distribution: distribution: 32 64 96 128 160 192 224 256 288 320 352 384 416 448 480 512 544 576 1024 1536 2048 2560 3072 3584 4096 4608 0.001 0.436 0.05 0.018 0.012 0.008 0.006 0.005 0.004 0.005 0.004 0.006 0.004 0.003 0.004 0.003 0.003 0.071 0.03 0.318 0 0 0 0 0 0 respective size: (multiply the two roles above respectively) 0.032 27.904 4.8 2.304 1.92 1.536 1.344 1.28 1.152 1.6 1.408 2.304 1.664 1.344 1.92 1.536 1.632 40.896 30.72 488.448 0 0 0 0 0 0 probability size (sum the line above up): 615.744 the error is: 615.744-581 = 34 bytes I have a question, how to get the packets size stat from a GSR? We know dcef is enable default in GSR, can we use dcef to get the stat ? thanks! ------------------------------------------------------ (Mr.) Yu(2) Ning(2) Int'l/Domestic Routing/Resource Man. ChinaNET(AS4134) Backbone Operation Center Networking Dep.,Datacom Bureau, China Telecom. Beijing,P.R.C +86-10-66418105/66418121/66418123(fax) ------------------------------------------------------