1. GINS The GARR Network Monitoring System
Giovanni Cesaroni, GARR
EUMEDCONNECT2 Training – Rome, June 2009

2. Agenda NOC Tools Motivation SNMP in action Required Functionality
PART 1
GINS description
NOC Tools Motivation
Required Functionality
Monitoring Environment
Statistics Examples
Visualization
Reports
Slicing
Traffic Flows Analysis
Work in progress
PART 2
Let’s code the Network Monitoring!
SNMP in action
BGP, OSPF, MPLS, IPv6
PART 3
RRD World
RRD in action
How to avoid loosing data
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

3. GARR Network E2E Capacity: ~40Gbps
43 POPs (University and Research Centre)
PEERING: 76 Gbps
52.5Gbps vs GEANT2
10G + 2.5G IP Access
3*10GE E2E links
9*1GE E2E links
3x2.5Gbps IP Transit
2 Milan + 1 Rome
7x1Gbps+10Gbps National PEERING
BackBone Capacity ~110Gbps
7 TLC Operators
Telecom Italia
Infracom (ex Autostrade TLC)
Fastweb
Interoute (ex Eurostrada)
WIND
BT-Italia (ex Albacom)
COLT-Telecom
3 International IP Carrier
Global Crossing
Telia
Level3
Access Capacity: ~60Gbps
Starting from 2M  10G
N.Access Links: 500
N.Backbone Links: 62
E2E Capacity: ~40Gbps
from 1G  10G
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

4. GOALS
Provide the NOC, Operations and Planning staff with all the tools needed to do their work as well as possible
Monitor users site connectivity
Check the status of the services at each level of the network
service oriented approach (not metric oriented)
Integrate monitoring services
Automate tools configuration
Give easy access to the information
Automatic generation of fault and performance reports
The goal is not to manage the control plane, but to have full control of the network
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

5. GINS Architecture GARR Network GARR NOC
Measurements Storage (MySQL & RRD)
Consistency Tools Robots
GINS Architecture
GINS Monitoring Tools
GINS Visualization Tools
GARR
Network
GARR NOC
GARR-DB: Network Database (Network Structure MySql)
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

6. GARR-DB: the Information System
administrative
and technical
information!!!
Logical “circuit” (IP link,MPLS LSP, lambda service, etc)
GARR Domain
Aggregate
physical object
segments
User Site
GARR
Backbone
physical circuit eq
physical objects
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

7. SW tools used by GINS Network ~5500 RRD files Scheduler: Cron Reports:
Data visualization:
PHP, HTML, Javascript, Ajax, SVG
Reports:
PHP, Jpgraph, HTMLDOC
~5500 RRD files
Data storage:
MySQL, File, RRD
Data management:
AWK, Bash, PHP, RRDtools
Network
Data acquisition:
MRTG, SNMP polls, ping
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

8. NOC in action GARR Backbone Alarms TLC NOC End Site APM GARR NOC
Trouble
Ticket
GARR NOC
APM
TLC NOC
Alarms
End Site
GARR
Backbone
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

9. GINS at a glance Main functionalities Network monitoring
Monitoring Services
Lambda
SDH/SONET
MPLS
IPv4, IPv6
OSPF, BGP
E2E
Multicast Beacons
Equipment
Network monitoring
Statistics acquisition
Trouble Ticket System
Fault and Performance Reports
Statistics Services
IPv4, IPv6, Multicast traffic
Physical interface errors
Routers CPU
Premium IP
SDH/SONET errors
Backbone weathermap
Uncompressed Statistics
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

10. Monitoring services
GINS detects/defines the status of different services, on the basis of the information gathered through the network.
Monitoring is supported on the following service classes:
IPv4 and IPv6: [service status, input errors and output drops on physical interfaces]
end-user site
backbone interface
IP Multicast Beacons [service status]
Routing protocols:
OSPF [link costs]
BGP [peering status, adv/rec routes]
SDH/Sonet [SDH/Sonet errors]
router interface on leased-lines
Lambda [service status, optical equipment port status]
MPLS [MPLS LSP status]
E2E: [E2E service status]
defined as the stitching of multiple intra-domain and inter-domain links
Monitoring functionalities
GINS detects/defines the status of different services, on the basis of the information gathered through the network. Monitoring is supported on the following service classes:
IPv4 and IPv6: end-user site and backbone interface [service status, input errors and output drops on physical interfaces]
IP Multicast Beacons [service status]
Routing protocols: OSPF [link costs] and BGP [peering status, adv/rec routes]
SDH/Sonet router interface on leased-lines [SDH/Sonet errors]
Lambda [service status, optical equipment port status]
MPLS [MPLS LSP status]
E2E: each E2E service is defined as the stitching of multiple intra-domain and inter-domain links. The status of the E2E service is defined on the basis of the status of all the intra/inter-domain links provided by each domain. Furthermore, each domain link is made up by an ensemble of heterogeneous links, e.g., IP links, MPLS LSPs, lambda, etc.. GINS is able to provide the status the domain links on the basis of the status of the constituting links and to export this data to the GN2 E2E Monitoring System [E2E service status]
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

11. Statistics services
GINS stores performance measurements data and provides:
Traffic Statistics
IPv4 and IPv6, Multicast for end user sites and backbone
Aggregate
Peering
Premium IP
Uncompressed Statistics
Sonet/SDH errors on leased lines
Router CPU load and temperature
Statistics functionalities
GINS stores performance measurements data, e.g., statistics relative to IP bandwidth usage, Sonet/SDH errors, etc., and provides graph (as a function of time) on the following metrics:
IPv4 and IPv6 Traffic Statistics
Backbone link traffic statistics
User traffic statistics
Aggregate traffic statistics
Peering traffic statistics
Backbone Traffic Weathermap
Premium IP traffic statistics
Sonet/SDH error statistics
Router CPU load statistics
End-user Uncompressed Statistics, i. e., 5 minute bandwidth usage data since the circuit setup
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

12. Other services
GINS includes a Trouble Ticket System which is highly customized for the GARR operations procedures. In particular, it manages user services, leased lines and PoP ticket.
Fault and performance reports:
User monthly and yearly reports (HTML and PDF)
User fault report and circuit availability
Uncompressed traffic statistics (IP BW usage, 95th percentile, etc.)
Carrier fault report and circuit availability (HTML and PDF)
Monitored physical devices:
Juniper J6350, M7i, M10, M20, M320
Cisco: 12xxx, 17xx, 18xx, 2xxx, 3750, 72xx, 75xx
ADVA FSP3000
Metrobility R4000, R5000
GINS includes a Trouble Ticket System which is highly customized on the GARR operations procedures. In particular, it manages user service, leased line and PoP tickets (currently no network equipment).
Fault and performance reports functionalities
GINS provides the following network fault and performance reports:
User Monthly Report (HTML and PDF)‏
User fault report and circuit availability
Uncompressed traffic statistics (IP Bandwidth usage, 95th percentile, etc.)‏
Carrier fault report and circuit availability (HTML and PDF)‏
Physical devices monitored
The following equipment are currently monitored:
Juniper J6350, M7i, M10, M20, M320
Cisco routers: 12xxx, 17xx, 18xx, 2xxx, 3750, 72xx, 75xx
ADVA FSP3000
Metrobility R4000, R5000
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

13. Monitoring Who is the target user of monitoring UIs?
The NOC & the Operation Staff, private access
Monitoring
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

14. Control Panel and IP Monitoring
BGP Alarms & Monitoring
E2E Monitoring, Lambda & MPLS
Other Services
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

15. Monitor Control Panel
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

16. NOC Interface (1/2) : links status
Last action
Traffic in/out
End Site Info
Telnet
Trouble ticket
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

17. NOC Interface (2/2): other services and quick ticket management
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

18. End Site Info Trouble Tickets Traffic Interface Errors
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

19. Physical Interface Input Errors and Output Drops
2Mbps
The link is going to be upgraded to a Gbps link in the next days!
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

20. E2E Monitoring Status of the “domain segment”
Status of the Interdomain Link
Aggregate status of the “domain link”
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

21. E2E Stitching MonitoringIP
MPLS LSP
10GE
Lambda
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

22. GINS vs Gn2 E2E CU GINS E2Emon GARR archive Switch & DFN GN2:JRA4
data aggregation
GN2 E2E CU
GARR NOC
Switch & DFN
E2Emon XML schema
GARR archive
GN2:JRA4
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

23. MPLS Monitoring GN2 GARR DFN MUPBED: one e2e connection TLAB TSystem
Informations on:
1- LSP1
2- L2 connection
GINS MPLS Service
TLAB
GN2 IT
GN2 TO
LSP2
GN2 DFN
GARR
SNMP Polls
LSP1
LSP3
MI1
DFN FF
MI2
TSystem
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

24. MPLS Monitoring: MUPBED case
LSP Status
E2E L2
inter-domain status
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

25. ... ... BGP monitoring Alarms Peer status & prefixes information
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

26. SONET Alarms (rfc2558)
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

27. Statistics Common statistics sets, different type of representation
Online Network Status
Other Services
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

28. Traffic, Input errors & output drops Long Term Analysis
CPU load
& temperature
Router
aggregate traffic
& peaks
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

29. Example of temperature statistics
In such cases I’d like to be alerted by , SMS, phone and voice!!!
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

30. The backbone weathermap
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

31. 25 20 615M Ticket info OSPF cost Router CPU temperature Traffic load
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

32. Traffic load Ticket info
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

33. How it works Weathermap HTML dynamic map SVG image PNG image Network
Merge
HTML dynamic map
SVG image
Generate
Convert
PNG image
Network
Measurements Storage
Network Database
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

34. Fault & Performance Reports
Who is the target user for network reports?
What kind of reports are provided?
1- Network users, end sites
fault and availability reports of the services
historical traffic data
Fault & Performance Reports
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

35. Fault & Performance Reports: UI
monthly report
95th percentile
Uncompressed
statistics
GARR User
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

36. User monthly and yearly PDF Reports
Introduction
Faults and availability
Monthly and yearly traffic statistics
~1,000 report pages per month
~50MB disk space per month
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

37. Uncompressed Traffic Statistics, monthly view
5 minutes
95th percentile
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

38. Uncompressed Traffic Statistics, yearly view
Monthly values
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

39. Historical data
2005!!
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

40. Fault & Performance Reports
Who is the target user for network reports?
What kind of reports are provided?
1- Network users, end sites
fault and availability reports of the services
historical traffic data
2- Network planning staff
to extrapolate the traffic trends for the future network planning
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

41. 30.67 Gbps 3.84 Gbps GARR Traffic Trends
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

42. Traffic Evolution GLOBAL INTERNET r ~ 1.4/y RESEARCH TRAFFIC r ~ 2.0/y
NATIONAL INTERNET r ~ 1.6/y
E2E
2001
2002
2003
2004
2005
2006
2007
2008
2009
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

43. Latency Measurements http://oss.oetiker.ch/smokeping/
By Tobias Oetiker
Latency Measurements
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

44. Latency Measurements Fping probe Server End Site
Round Trip Time fluctuations
Packet Loss pecentage
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

45. GARR-DB: Network Database
Description of the infrastructure
Slices
Temporary infrastructures
Network Labs
Homer’s dream
is just:
Temporary research projects
Infrastructures requiring monitoring only
Dedicated monitoring systems (users or projects)
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

46. Slices Dedicated monitoring systems User requirements:
Quick and easy setup
Traffic statistics
Weathermaps
Alarms
Administrator requirements:
Easy to manage
Replicable
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

47. Slices Slice link, description and status MRTG log status
Url
Status of MRTG CFG generation (red if disabled)
Slice status (on,off)
Access policy
Cronjob status (red if disabled)
MRTG log status
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

48. Slices
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

49. Traffic Flows Analysis
Based on NetFlow protocol
Traffic Flows Analysis
Suite Nfsen/Nfdump by Peter Haag
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

50. Traffic Flows Analysis, architecture overview
RRDs
User
Nfdump (CLI)
www
Nfsen
Nfdump
Raw data
Nfcapd
NetFlow, data export, sampling
Network
Daily numbers:
~2000 flows/s export
sampling 1:1000
~40MB-1.6GB each router (raw data)
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

51. Traffic Flows Analysis, example
Servers vs DHCP
Analysis of 2 subnets traffic on one interface
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

52. MRTG vs NetFlow GINS (SNMP) Nfsen (NetFlow)
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

53. Do I trust sampling? From router counters (GINS by MRTG):
From flows (NetFlow):
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

54. Traffic Flows Analysis with ASTracker
ASTracker Nfsen plugin by Nino GARR = + + + + + + +
How to get information on the traffic exchanged between ASes?
Example of an IP commodity peering
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

55. Traffic Flows Analysis with ASTracker: Microsoft black hole
Microsoft AS8075 announce by GEANT
Output traffic on Geant, input traffic lost
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

56. Traffic Flows Analysis with ASTracker: other examples
Facebook:
From the Microsoft Web Site
“As part of Microsoft's routine, monthly security update cycle,
we released 10 new security updates on June 9, 2009”.
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

57. Work in progress Tools that are currently going to be integrated:
Reports on Traffic Flows Analysis
Equipment SNMP Traps
Future plans:
Packaging: module packaging for distribution
Optical Network Monitoring
GINSv2
Optical Network
Operations
Support
System
GINS
Tell me guy!
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

58. LET’S CODE THE NETWORK MONITORING!
Part 2
LET’S CODE THE NETWORK MONITORING!
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

59. SNMP, RFC
n. 1441
Introduction to version 2 of the Internet-standard Network
Management Framework
n. 2578
Structure of Management Information for version 2 of the Simple Network Management Protocol (SNMPv2)
n (updates 2011,2013,2013)
Management Information Base for Network Management of TCP/IP-based internets: MIB-II
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

60. SNMP 2 different approaches: SNMP POLL SNMP TRAP You ask for something
The equipment sends a response
The equipment advises you about an event
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

61. USING SNMP, POLL
snmpget -v2c -c <community> <router> <Object Identifier OID>
snmpwalk -v2c -c <community> <router> <part of an OID>
Poll response: <OID> = <data type>: <value>
Basic examples:
snmpget -v2c -c <community> <router> IP-MIB::ipAdEntIfIndex
IP-MIB::ipAdEntIfIndex = INTEGER: 82
snmpget -v2c -c <community> <router> IF-MIB::ifName.82
IF-MIB::ifName.82 = STRING: ge-1/2/0.4
snmpget -v2c -c <community> <router> IF-MIB::ifHighSpeed.82
IF-MIB::ifHighSpeed.82 = Gauge32: 1000
snmpget -v2c -c <community> <router> IF-MIB::ifHCInOctets.82
IF-MIB::ifHCInOctets.82 = Counter64:
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

62. SNMP in action: BGP Monitoring
Status of the Peer BGP: (RFC 1269)
snmpwalk -v2c -c <community> <router> |
awk -F 'SNMPv2-SMI::mib ' '{print $2}' |
awk -F ' = INTEGER: ' '{
if($2=="1"){status=sprintf("Idle");};
if($2=="2"){status=sprintf("Connect");};
if($2=="3"){status=sprintf("Active");};
if($2=="4"){status=sprintf("Opensent");};
if($2=="5"){status=sprintf("Openconfirm");};
if($2=="6"){status=sprintf("Established");};
print $1,status;}'
Returns a list of:
<IP address of the Peer> <Status of the Peer>
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

63. SNMP in action: BGP Monitoring
AS of the Peer BGP: (RFC 1269)
snmpwalk -v2c -c <community> <router> |
awk -F 'SNMPv2-SMI::mib ' '{print $2}' |
awk -F ' = INTEGER: ' '{print $1,$2;}'
Returns a list of:
<IP address of the Peer> <AS of the Peer>
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

64. SNMP in action: BGP Monitoring
A rude but simple BGP Monitor
Content of /<some path>/BGPmon.sh
#!/bin/bash
snmpwalk -v2c -c <community> <router> |
awk -F 'SNMPv2-SMI::mib ' '{print $2}' |
awk -F ' = INTEGER: ' '{
if($2!="6"){alarm=sprintf(“The Peer has a problem: ");};
print alarm,$1;}'
In the crontab
0-55/5 * * * * /<path>/BGPmon.sh
Why rude?
0- If a peering goes down for 24 hours, I get 288 s, please change the address!!!
1- A better way of coding is to use the libraries of an higher language (php, perl, java, etc.), allowing you to manage errors, performances and historical data
Why simple? Just a lovely command line
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

65. SNMP in action: BGP Monitoring
Monitoring BGP Prefixes
no more standard MIBs available
CISCO-BGP4-MIB
Accepted prefixes from Peer
<IP>.1.1 (.1.1 = IPv4 Unicast)
Advertised prefixes to Peer
<IP>.1.1
BGP4-V2-MIB-JUNIPER
Received prefixes from Peer
<Peer Index>.1.1
<Peer Index>.1.1
<Peer Index>.1.1
Peer Index from:
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

66. SNMP in action: OSPF Monitoring
OSPF cost of a link:
<IP Address>.0.0
(RFC 1850)
snmpwalk -v2c -c <community> <router> |
grep '.0.0 =' |
awk -F '.0.0 = INTEGER: ' '{print $1,$2}' |
awk -F 'SNMPv2-SMI::mib ' '{print $2}'
Returns a list of:
<IP address> <OSPF cost>
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

67. SNMP in action: MPLS LSP Monitoring
On Juniper Routers:
To get the information about an LSP,
we have to know the index identifying
the LSP (<LSP index>),
Example:
BO1-MI1-VPN :
snmpget -v2c -c <comunity> <router>
<mplsLspState>.<LSP index>
1 = unknown
2 = up
3 = down
Some information:
mplsLspName
mplsLspPathChanges
mplsLspLastPathChange
mplsLspConfiguredPaths
mplsLspStandbyPaths
mplsLspOperationalPaths
mplsLspFrom
mplsLspTo
mplsPathName
mplsPathType
mplsPathExplicitRoute
mplsLspState
mplsPathRecordRoute
mplsPathBandwidth
mplsPathCOS
mplsPathInclude
mplsPathExclude
mplsPathSetupPriority
mplsPathHoldPriority
mplsPathProperties
mplsLspOctets
mplsLspPackets
mplsLspAge
mplsLspTimeUp
mplsLspPrimaryTimeUp
mplsLspTransitions
mplsLspLastTransition
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

68. SNMP in action: MPLS LSP Monitoring
How to build the LSP index:
B O M I
CHAR to DEC translation
<?
$name=$argv[1];
$oid=name2oid($name);
print $name.": ".$oid."\n";
function name2oid($string) {
$oid = '';
$len = strlen($string);
for ($i = 0; $i < $len; $i++) {
$oid .= ".".str_pad(ord($string[$i]), 2, 0, STR_PAD_LEFT); }
$npoints=32-$len;
for ($i=0;$i<$npoints;$i++){
$oid .= ".0";
return $oid;
?>
Build the monster using a translator
(or use an ASCII table on wikipedia):
$ php name2oid.php BO1-MI1-VPN
BO1-MI1-VPN:
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

69. SNMP in action: IPv6 traffic
There are no IPv6-MIBs available to measure the IPv6 traffic on the
Interfaces on Cisco and Juniper Routers.
A solution for Juniper Routers is using the firewall,
defining a counter for the IPv6 traffic
1- firewall configuration
> show configuration firewall
family inet6 {
filter ipv6-traffic {
interface-specific;
term count {
then {
count ipv6-traffic;
accept; }
2- interface configuration
> show configuration interfaces ge-0/2/4.0 family inet6
filter {
input ipv6-traffic;
output ipv6-traffic; }
3- result
> show firewall | grep ipv6
Filter: ipv6-traffic-ge-0/2/4.0-i
ipv6-traffic-ge-0/2/4.0-i
Filter: ipv6-traffic-ge-0/2/4.0-o
ipv6-traffic-ge-0/2/4.0-o
And now is time to understand how the OID counter is built
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

70. SNMP in action: IPv6 traffic
From JUNIPER-FIREWALL-MIB:
jnxFWCounterDisplayFilterName:
jnxFWCounterDisplayName:
And what we need to measure:
jnxFWCounterByteCount:
How to build the index of the counter?
After some long reverse engineering….
<length of the filter_name> +
<CHAR to DEC translation of the filter_name> +
<length of the counter_name> +
<CHAR to DEC translation of the counter_name> + .2
In this case the filter_name and the counter_name are the same
(ipv6-traffic-ge-0/2/4.0-i)
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

71. SNMP in action: IPv6 traffic
Example for the counter on the ae1.0 interface:
ipv6-traffic-ae1.0-i : .2
Finally, you can get the counter value by snmp or you can use the OID in a MRTG configuration file.
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

72. RRD World Where to find all the information:
thanks to Tobias Oetiker
How to store data in an efficient and systematic manner:
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

73. RRD World MRTG CACTI Storage SNMP Polls RRD API Network Handmade
or other
poller
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

74. The RRD file: RRD World a possible and typical temporal structure:
Round Robin Archive: RRA
a possible and typical temporal structure:
600 values
Average on
5 minutes
30 minutes
2 hours
1 day
50 days
600 days
12.5 days
50 hours
600
AVERAGE
600
MAX
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

75. RRD in action: RRD World New value 600 values Average on 5 minutes
2 hours
1 day
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

76. RRD World: how to avoid loosing data, method 1
First thing to do:
Change the size of the yearly RRA, for example to 10 years
3650 values
600 values
600 values
600 values
600 values
Average on
5 minutes
30 minutes
2 hours
1 day
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

77. RRD World: how to avoid loosing data , method 1
RRD API:
Info, create, update, fetch, tune, graph, dump, restore, etc.
rrdtool resize <file.rrd> 3 GROW 3050
RRA number
rrdtool info <file.rrd>
rra[0].cf = "AVERAGE"
rra[0].rows = 600
rra[0].pdp_per_row = 1
rra[1].cf = "AVERAGE"
rra[1].rows = 600
rra[1].pdp_per_row = 6
rra[2].cf = "AVERAGE"
rra[2].rows = 600
rra[2].pdp_per_row = 24
rra[3].cf = "AVERAGE"
rra[3].rows = 600
rra[3].pdp_per_row = 288
rra[0].cf = "AVERAGE"
rra[0].rows = 600
rra[0].pdp_per_row = 1
rra[1].cf = "AVERAGE"
rra[1].rows = 600
rra[1].pdp_per_row = 6
rra[2].cf = "AVERAGE"
rra[2].rows = 600
rra[2].pdp_per_row = 24
rra[3].cf = "AVERAGE"
rra[3].rows = 3650
rra[3].pdp_per_row = 288
10 years RRD
5 m
30 m
2 h
1 d
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

78. RRD World : how to avoid loosing data , method 2
Building RRD without compression:
600 values
600 values
600 values
600 values
12 values
12 values
Script
(every hour)
Average on
5 minutes
Average on
30 minutes
Average on
2 hours
Average on
1 day
Yearly RRD without compression
Single RRA with values
Average on
5 minutes
366 days
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

79. RRD World : how to avoid loosing data , method 2
Building RRD without compression:
how to do it
1- Uncompressed RRD creation (once for year):
rrdtool create <destination.rrd>
> start <some year ago> --step 300
> DS:in:GAUGE:600:U:U DS:out:GAUGE:600:U:U
> RRA:LAST:0.5:1:105408
2- Data extraction and insertion (once for hour):
rrdtool fetch <source.rrd> --end now-600s --start now-4200s AVERAGE |
awk -F ' ' 'BEGIN {x=0;}{x++; if (x>2){ print $1 $2":"$3 } }' |
xargs rrdtool update <destination.rrd>
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009

80. Reference URL: www.gins.garr.it Email: sw.dev@garr.it
Giovanni Cesaroni, EUMEDCONNECT2 Training, Rome June 2009