1. Network Management: Accounting and Performance Strategies - Graphically Rich Book Network Management: Accounting and Performance Strategies by Benoit Claise - CCIE No. 2686; Ralf Wolter Publisher: Cisco Press Pub Date: June 20, 2007 Print ISBN-10: 1-58705-198-2 Print ISBN-13: 978-1-58705-198-2 Pages: 672

2. Understanding the need for Accounting Management What is accounting management? Why do networks require accounting management? Why is accounting almost a stealth area within network management? Which problems do accounting management solutions solve? How can the business use this information for network planning, redesign, and billing? What aspects make up accounting (data collection, data analysis, reporting, billing, and so on)?

3. Defining accounting management

4. ITU-T definition (M.3400 and X.700, Definitions of the OSI Network Management Responsibilities): "Accounting management enables charges to be established for the use of resources in the OSIE [Open Systems Interconnect Environment], and for costs to be identified for the use of those resources”

5. ITU-T definition (M.3400 and X.700, Definitions of the OSI Network Management Responsibilities): "inform users of costs incurred or resources consumed” inform "enable accounting limits to be set and tariff schedules to be associated with the use of resources; limit "enable costs to be combined where multiple resources are invoked to achieve a given communication objective." Cost combine Accounting management includes functions to:

6. Telecommunication Management Forum (TMF) definition: ITU M3400additional details for billing in the enhanced Telecom Operations Map (eTOM) + TMF = The Fulfillment, Assurance, and Billing (FAB) model of TMF's eTOM

7. Telecommunication Management Forum (TMF) definition:  The TMF refers to the ITU-T accounting definition (M.3400) and provides additional details for billing in the enhanced Telecom Operations Map (eTOM), The Business Process Framework, Document GB921.  The Fulfillment, Assurance, and Billing (FAB) model of TMF's eTOM positions the "Network Data Management" building block between assurance and billing.  "Network Data Management: this process encompasses the collection of usage data and network and information technology events and data for the purpose of network performance and traffic analysis. This data may also be an input to Billing (Rating and Discounting) processes at the Service Management Layer, depending on the service and its architecture." Chapter 3 explains the FAB model in more detail.

8. IETF definition: Request For Comment (RFC) 2975, Introduction to Accounting Management the collection of resource consumption data for the purposes of capacity and trend analysis, cost allocation, auditing, and billing. Accounting management requires that resource consumption be measured, rated, assigned, and communicated between appropriate parties."

9. In this book, we use the term accounting management to describe the following processes: Collecting usage data records at network devices Optionally preprocessing data produced by the device (for example, filter, sample, aggregate) Exporting the data from the device toward a collection server Processing the data at the collection server (for example, filter, sample, aggregate, de-duplicate) Converting usage records into a common format to be used by higher- layer applications : the mediation procedure performance, SLA, fault, security, billing, planning, and so on

10. Figure 1-3. Accounting Management Architecture

11. Collecting usage data records at network devices

12. Figure 1-3. Accounting Management Architecture Optionally preprocessing data produced by the device (for example, filter, sample, aggregate)

13. Figure 1-3. Accounting Management Architecture Exporting the data from the device toward a collection server

14. Figure 1-3. Accounting Management Architecture Processing the data at the collection server (for example, filter, sample, aggregate, de- duplicate)

15. Figure 1-3. Accounting Management Architecture Converting usage records into a common format to be used by higher-layer applications (for example, performance, SLA, fault, security, billing, planning, and so on): the mediation procedure

16. Figure 1-5. Network Management Building Blocks the focus of accounting is to track the usage of network resources and traffic characteristics.

17. The Purposes of Accounting Various accounting scenarios: Network monitoring User monitoring and profiling Application monitoring and profiling Capacity planning Traffic profiling and engineering Peering and transit agreements BillingSecurity analysis

18. Network Monitoring Class 0Class 1Class 2 Time (Hour) PacketsBytesPacketsBytesPacketsBytes 038273513005980031002 155367640044700619791 24136661400168004240 313166020084004424 41614456400447004420 519272140044400148 621247256003560051620648 719306470041220015677 859251200176000148 9445713001041001242 148920 5 10530041900 109190 0 148 1144514003980054522641 124456800542001017 108969 9 13551050041600363240 14445540099300153287 1555118003680068527578 16445410040003144 1744575003095002322 184455400341004192 195309513001041004424 204398100152004424 21511268005420012936 22778213001041004835 2397701600356001235 Table 1-2. Example of a Daily Report with Three Servicee Classes back

19. User Monitoring and Profiling next The trend of running mission-critical applications on the network is OVERWHELMING Voice over IP (VoIP), virtual private networking (VPN), and videoconferencing are increasingly being run over the network. At the same time, people use (abuse?) the network to download movies, listen to music online, perform excessive surfing, and so on.

20. User Monitoring and Profiling back This information can be used to: Build a traffic matrix per subdivision, group, or even user Track network usage per user Monitor and profile users A traffic matrix illustrates the patterns between the origin and destination of traffic in the network Document usage trends by user, group, and department Identify opportunities to sell additional value-added services to targeted customers.

21. Application Monitoring and Profiling Figure 1-7. Characterizing Traffic by Application back

22. Figure 1-8. IP Protocol Distribution

23. Table 1-3. Example of Daily Report (Extended Version) Class 0Class 1Class 2 Load Application (Bytes) Load Application (Bytes) LoadApplication (Bytes) Time (Hour)PacketsBytesVoiceOtherPacketsBytesE-mailSAPPacketsBytesHTTP Peer-to- Peer Other 038273526424711300598003887020930131002752100150 1553676128354840044700290551564561979188129790 2415666178055881400168001092058804240216240 313166032813322008400546029404424382420 41614456128143284004470029055156454420378420 5192721116415574004440028860155401048048 384 62124725985614869600356002314012460516206481858320650 71930642048101670041220026793014427015677609680 85925512413120017600011440061600129604896816 94457256201130010410067665364351242148920513402851489210 105300416841320190010919007097353821653256230260 11445196355400398002587013930545226412037722640 12445664392800542003523018970101710896999807291089700 13551012838250041600270401456036324029163240 1444554163940099300645453475515328729583290 15551149615800368002392012880685275782482027580 1644541283261004000260014003144130140 1744572562015003095002011751083252322290320 1844551962594003410022165119354192173190 5309520481047130010410067665364354424382420 20439828611210015200988053204424382420 215112695617080054200352301897012936842940 227782612170130010410067665364354835752840 2397701209656056003560023140124602235212240

24. Capacity Planning A service provider might consider the following: next

25. Capacity Planning A service provider might consider the following: next Which point of presence (PoP) generates the most revenue? POP Which access points are not profitable and should be consolidated? ACCES S Should there be spare capacity for premium users? SPARE CAPACITY In which segment is the traffic decreasing? Did we lose customers to the competition? What might be the reason? SEGMENT

26. Capacity Planning An enterprise IT department might consider the following Which departments are growing the fastest? Which links will require an upgrade soon? GROW For which department is network connectivity business-critical and therefore should have a high-availability design? HIGH AVAILABILITY back