1 Netflow Collection and Aggregation in the AT&T Common Backbone Carsten Lund

5/31/2002 AT&T Proprietary2 Netflow Measurements  Detailed IP flow measurements Attributes defining flows Source IP, Destination IP, Source Port, Destination Port, Protocol, etc, Statistics about flows Bytes, Packets, Start time, End time, etc.  Semi-standard Cisco, Juniper, etc.

5/31/2002 AT&T Proprietary3 Pro and Cons  Pro Detailed On all time everywhere. Router feature (e.g., part of the router)  Con Huge amount of data (500GB/day) Router feature How well is this feature supported. We have had lots of problems.  Conclusion This is the only way currently to get detailed IP measurements for ubiquitous deployment.

5/31/2002 AT&T Proprietary4 TAP Traffic Analysis Project  Collection Servers Servers in each major POP that collects the netflow measurements  Aggregation Software that processes the netflow measurements and create aggregate summaries  Reports Generate various reports for end users of the system  Joint Project Development, Product Mgt, and Research

5/31/2002 AT&T Proprietary5 TAP Architecture TAP ar1 ar2 ar3 igr1 ar1 ar2 ar3 igr1 Central Server Collected Data TAP Router Measurement Servers

5/31/2002 AT&T Proprietary6 Aggregation: Tap Query  Query API for the distributed Netflow collection system Analogous to SQL for RDBMS.  Simple query language

5/31/2002 AT&T Proprietary7 TAP Query Architecture Application User ar1 ar2 ar3 igr1 Tap Query API ar1 ar2 ar3 igr1 Central Server External Data catcher Tap Query Netflow Data Aggregate Data catcher Controller Tap Query queries

5/31/2002 AT&T Proprietary8 Features  Join: joining netflow data with external data sources  Filter: simple (straight line program) based on field by field comparisons.  Aggregation  Multiple simultaneous queries  Add new queries on the fly  High level specification of query location

5/31/2002 AT&T Proprietary9 Features (continued)  Context-dependent external data sources  On-the-fly update of external data sources  Automatic, configurable loss correction  Sophisticated netflow sampling  Efficiency  Also works offline

5/31/2002 AT&T Proprietary10 Domain Specific Language

5/31/2002 AT&T Proprietary11 Smart Sampling  We need to sample the netflow stream Problem: Some records are more important than others. E.g., huge file transfers. Solution: Size dependent sampling. Sampling Probability 1 Flow size samplingFactor

5/31/2002 AT&T Proprietary12 The Whole Process Flow Creation 4211 Packet Sampling Netflow Data Loss 1612 Smart Sampling 421 (e.g. 25% loss) (e.g. 1 in 3 sampling) (e.g. samplingFactor=3) = 4*3/0.75 = 3*3/0.75

5/31/2002 AT&T Proprietary13 Status  In production mode for Peering links Subset of cable costumer interfaces (MSO) Planned deployment on whole access side in 2002Q3.

5/31/2002 AT&T Proprietary14 Data Volumes

5/31/2002 AT&T Proprietary15 Current/future Applications Real-time and Offline  Traffic Engineering Traffic matrices (Capacity Management) BGP TE  Traffic monitoring (DNS traffic, etc.)  Application Profiles e.g., 50% of AT&T Broadband traffic is P2P (E.g., Kazaa, Gnutella, etc) AT&T Broadband is a large content provider.  Costumer Profiles  Content Provider Profiles  Content Provider Performance Monitoring  Security (DDOS, IDS)  Etc….